Unscored CVE-2020-17448 EUVD-2020-9400GHSA-ccch-f948-2h8c

Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrate…

Published Aug 11, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: telegram-desktop Package: telegram-desktop Ecosystem: Debian Ecosystem: Ubuntu

Description

Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	telegram-desktop	2.2.0+ds-1	—
Debian 12	telegram-desktop	2.2.0+ds-1	—

Ubuntu