A security issue was discovered in tigervnc related how the viewers handle TLS certificate exceptions. Tigervnc before 1.11.0 stored the certificates as authorities, meaning that the owner of that certificate could impersonate any server it wanted after a client had added an exception. Tigervnc 1.11.0 handles this properly by only storing exceptions for specific hostname/certificate combinations, as done by HTTP user agents or SSH.
This flaw can be mitigated by not making certificate exceptions in the affected versions of tigervnc, and therefore they will not be stored as authorities.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2021:1783 https://access.redhat.com/errata/RHSA-2021:1783