CVE-2020-26117
27.09.2020, 04:15
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| tigervnc | tigervnc | 𝑥 < 1.11.0 |
| debian | debian_linux | 9.0 |
| opensuse | leap | 15.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libXvnc1 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| tigervnc |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| xorg-x11-Xvnc |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| xorg-x11-Xvnc-module |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| xorg-x11-Xvnc-novnc |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| tigervnc |
| ||
| tigervnc-icons |
| ||
| tigervnc-license |
| ||
| tigervnc-selinux |
| ||
| tigervnc-server |
| ||
| tigervnc-server-minimal |
| ||
| tigervnc-server-module |
|
Common Weakness Enumeration
References