| Newsgroups |
gmane.linux.lfs.beyond.book |
| Message-ID |
<[email protected]> |
#23458: FreeRDP-3.27.1
-------------------------+-------------------------------
Reporter: Bruce Dubbs | Owner: SecurityAdvisory
Type: enhancement | Status: new
Priority: elevated | Milestone: 13.1
Component: BOOK | Version: git
Severity: normal | Resolution:
Keywords: |
-------------------------+-------------------------------
Changes (by Joe Locash):
* owner: Joe Locash => SecurityAdvisory
* status: assigned => new
Comment:
{{{
# 2026-06-15 Version 3.27.0
A major feature / bugfix / cleanup release
What did change:
* Password hash now uses a custom SSPI attribute on non windows systems
* TLS seclevel now defaults to 2 and a minimum of TLS 1.2 is required.
Client side the /tls:seclevel:<number> and /tls:enforce:<version> allow
to ov
erride these.
Server implementations can manually set these with
rdpSettings::FreeRDP_TLSMi
nVersion and
rdpSettings::FreeRDP_TlsSecLevel
(See https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/ for
more d
etails)
* The RDP proxy got a fix which removed (unstable) structs from public
headers.
There are no
known users of that (internal) API, but if you happen to be one please
ping u
s.
* Android client got some huge updates again (thank @svncibrahim)
* Enhancements with Azure/Entra support: some (known but not officially
documen
ted) extensions
have been added to make these connections more stable.
* keyboard mapping
* Allow RDPDR channel to pass additional arguments to the channel. Does
not bre
ak existing behaviour
but allows a channel supporting this to query the additional arguments
for fu
rther use.
* Fix some WinPR deprecation handling, add WITHOUT_WINPR_3x_DEPRECATED
that all
ows building
without any symbol deprecated during the stable 3 series
* Some client side statistics logging API was added. By default prints a
(trace
) log at the
end of a session, but it can be queried at any time for some connection
detai
ls.
## CVE (Reported by SecBuddyF, Tencent Keen Lab)
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-
3mf5-f5cx
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rp4-66mc-
j9vx
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-
frm6
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-
vx73-w5q6-7jqr
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-
h2f6 (Re
ported by @f9j2n6nd8k-eng)
## What's Changed
* Call winpr_InitializeSSL in TestWinPRUtils/TestNTLM (#12746)
* [core,codec] Fix invalid overlap check (#12753)
* Improve clipboard massive files copying performance (#12743)
* [crypto,certificate] Honor BIO_should_retry (#12755)
* Unify PEM read routines (#12758)
* Build updates (#12772)
* Fix sdl3 clipboard for files (#12759)
* url: replace http://www.freerdp.com (#12781)
* Fuzz/analyzer fixes (#12791)
* [winpr,sspi] replace password-length heuristic with explicit hash
(#12782)
* Claude suggestions (#12792)
* Disp check fix (#12795)
* [core,settings] Raise default security level (#12752)
* [clang,tidy] use workflow from ZedThree (#12806)
* Improve FIPS mode support (#12811)
* Lots of android specific improvements (#12773, #12777, #12783, #12784,
#12785,
#12786, #12787, #12788, #12807, #12812, #12815, #12818, #12819, #12820,
#12822,
#12748, #12750)
* [channels,audin] fix opensles error handling (#12751)
* [channels,audin] fix iOS and mac backends (#12864)
* [channels,cliprdr] refactor server channel (#12810)
* [channels,cliprdr] reset stream after use (#12855)
* [channels,drdynvc] add new PubSub events (#12760)
* [channels,rail] fix client handshake response (#12780)
* [channels,rdpdr] various enhancements (#12800, #12797, #12803)
* [channels,rdpgfx] fix server frame command returning success on write
failure (#12828)
* [channels,rdpsnd] reject client audio formats with zero
nChannels/nBlockAlign (server-side DoS) (#12829)
* [channels,rdpsnd] skip unusable playback backend during selection
(#12830)
* Refactor printer queue (#12817)
* [ci,freebsd] update ci (#12823, #12824, #12825)
* [cmake,simd] guard CMAKE_OSX_ARCHITECTURES (#12802)
* [cmake] replace find_package(GLOBAL) (#12837)
* [cmake] fix use of pkg_check_module (#12838)
* [winpr,input] complete japanese keyboard mapping (#12836)
* winpr/input: Fix numpad mapping for japanese keyboards (#12845)
* [core,gateway] validate auth blob length in rdg_process_extauth_sspi
(#12856)
* Restore fullscreen when maximizing a toggled fullscreen window (#12849)
* Fix(wfreerdp): Refresh Windows frame after fullscreen restore (#12848)
* Fix copying multiple items of the same type between xfreerdp sessions
(#12834)
* [core,event] add StateChanged event (#12858)
* [core,nego] bound cookie tag check to remaining length (#12862)
* codec stats (#12860)
* Various warning fixes (#12749, #12813, #12866, #12831)
* [core,client] add PubSub events (#12757)
* [core,client] use correct interface pointer (#12766)
* [client,rdpewa] filter UserNotify events (#12767)
* [client,windows] honor /from-stdin in wfreerdp (#12821)
* [client,x11] release normal keys before modifiers (#12868)
* fix(client/SDL): do not treat an unrecognized mouse button as fatal
(#12847)
* Proxy client context (#12865)
* [core,update] filter out unused/unknown (#12870)
* Azure/Entra undocumented stuff and request compaction (#12872, #12871,
#12770)
* Various bounds checks (#12873, #12857)
* Sspi separate ansi unicode (#12874)
* Ci update qa (#12875)
* [channels,gfx] extract remaining header length (#12876)
* [cache,glyph] bound offset read to buffer length (#12881)
* Expose the correlationId in settings (#12879)
* [winpr,wtypes] fix WINPR_C23_ENUM_TYPE (#12882)
* [server,proxy] pass ntlm hostname (#12877)
}}}
{{{
# 2026-06-17 Version 3.27.1
Bugfix/regression fix and android feature release
What did change:
* Fixed a regression with gateway connections
* Android client RDPECAM support
* Android client RAILS support
## CVE
* https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-
3prp
## What's Changed
* [core,utils] fix guid2str (#12898)
* [client,android] Add RAIL/RemoteApp window support (#12887)
* Bitmap decode (#12899)
* [client,rdpecam,android] Add camera redirection support (#12894)
* [tools] make the generator create more clang-format friendly code
(#12900)
}}}
Fixed at [sha:95b7de417e]. Leaving open for SA.
--
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23458#comment:3>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch
--
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page