{"schema":"threatline.record/2","record":{"id":"GHSA-pjxv-5j98-cqx4","aliases":["GHSA-pjxv-5j98-cqx4"],"summary":"FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured","details":"## Summary\r\n\r\nThe FreeRDP proxy enables external certificate management for its outbound target connection. Its certificate callback accepts the target certificate when no proxy module vetoes it. A network-positioned attacker can therefore impersonate the configured RDP target with a self-signed, wrong-hostname certificate. In a live proxy replay, the default no-module configuration sent 395 post-TLS RDP bytes; a required rejecting module sent zero.\r\n\r\n## Prerequisites\r\n\r\nThe deployment uses the FreeRDP proxy with TLS to its target and has no module that validates and rejects the presented target certificate. The attacker must receive or intercept the proxy's outbound connection, and a user must initiate a proxied session.\r\n\r\n## Remediation\r\n\r\nNo upstream fix was found in current master. Recommended remediation is normal chain and hostname verification for the outbound target, or fail-closed external management that requires an explicit verifier decision.","categories":["Unclassified"],"product":"FreeRDP","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4","source_modified_at":"2026-10-05T20:28:46Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"c","name":"FreeRDP"},"range":">= 2.0.0, <= 3.31.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4","source_modified_at":"2026-10-05T20:28:46Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"c","name":"FreeRDP"},"version":"3.32.0"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T20:28:46Z","modified_at":"2026-10-05T20:28:46Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4","fetched_at":"2026-10-25T21:40:15.971031Z","source_modified_at":"2026-10-05T20:28:46Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T20:28:46Z","content_hash":"aba9c91fc06b2c81b1cac1b08a551d8a3e010094f78dc8275a1ee32759c8a922"}}