Bug 2143647 (CVE-2022-39347)

Summary: CVE-2022-39347 freerdp: missing path sanitation with `drive` channel
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: oholy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: freerdp 2.9.0 Doc Type: If docs needed, set a value
Doc Text:
A directory traversal issue was discovered in FreeRDP. The vulnerability exists due to missing path canonicalization and base path check for the drive channel. A malicious server can trick a FreeRDP based client to read files outside of the shared directory. This issue allows an attacker to gain access to sensitive information.
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 21:41:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2143663, 2143666, 2143670, 2143674, 2145139, 2145140    
Bug Blocks: 2143404    

Description TEJ RATHI 2022-11-17 13:37:21 UTC
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch.

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg

Comment 1 TEJ RATHI 2022-11-17 13:51:30 UTC
Created freerdp tracking bugs for this issue:

Affects: fedora-35 [bug 2143666]
Affects: fedora-36 [bug 2143670]
Affects: fedora-37 [bug 2143674]


Created freerdp1.2 tracking bugs for this issue:

Affects: epel-7 [bug 2143663]

Comment 3 errata-xmlrpc 2023-05-09 07:29:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2326 https://access.redhat.com/errata/RHSA-2023:2326

Comment 4 errata-xmlrpc 2023-05-16 08:20:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2851 https://access.redhat.com/errata/RHSA-2023:2851

Comment 5 Product Security DevOps Team 2023-05-16 21:41:16 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-39347