CVE-2022-24882

Publication date 26 April 2022

Last updated 18 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.1 · Critical

Score breakdown

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.

Status

Package Ubuntu Release Status
freerdp2 26.10 stonking Not in release
26.04 LTS resolute Not in release
25.10 questing Not in release
25.04 plucky
Not affected
24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic
Not affected
22.04 LTS jammy
Fixed in 2.6.1+dfsg1-3ubuntu1
21.10 impish
Fixed in 2.3.0+dfsg1-2ubuntu0.2
20.04 LTS focal
Fixed in 2.2.0+dfsg1-0ubuntu0.20.04.3
18.04 LTS bionic
Fixed in 2.2.0+dfsg1-0ubuntu0.18.04.3
freerdp 18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.1 · Critical

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities