Summary
It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker's server.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | tigervnc | 1.7.0+dfsg-8ubuntu2+esm1 |
Vulnerabilities 1
-
Unscored —
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptio…
References
-
report
https://ubuntu.com/security/CVE-2020-26117