Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 7: MGASA-2020-0388 Critical Tigervnc TLS Impersonation Issue

mageia
Calendar Grey October 20, 2020
Dist Mageia Esm H88
The Tigervnc packages in Mageia 7 have been revised to rectify a significant vulnerability related to TLS certificate management.
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions

Summary

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception. (CVE-2020-26117)

References

- https://bugs.mageia.org/show_bug.cgi?id=27270

- https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XJC7PGEFEUUZTWSX7CGQG5YLB3NCQ6BO/

- https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html

- - https://www.cve.org/CVERecord?id=CVE-2020-26117

Topics%20covered

Topics Covered

security advisory DoS security fix impersonation tigervnc Mageia TLS certificate

Resolution

SRPMS

- 7/core/tigervnc-1.10.1-1.2.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 20 Oct 2020
URL: https://advisories.mageia.org/MGASA-2020-0388.html
Type: security
CVE: CVE-2020-26117

Topics%20covered

Topics Covered

security advisory DoS security fix impersonation tigervnc Mageia TLS certificate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here