{"id":"CVE-2020-26117","aliases":["DEBIAN-CVE-2020-26117","DLA-2396-1","EUVD-2020-18747","GHSA-cx25-8g49-fx7q","MGASA-2020-0388","RHSA-2021:1783","RLSA-2021:1783","SUSE-SU-2020:2880-1","SUSE-SU-2020:2881-1","SUSE-SU-2020:2882-1","SUSE-SU-2020:2898-1","UBUNTU-CVE-2020-26117","USN-5965-1","openSUSE-SU-2020:1666-1","openSUSE-SU-2020:1841-1","openSUSE-SU-2024:10591-1"],"status":"published","title":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle...","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0306,"percentile":0.87775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-09-27T03:30:25Z","modified":"2026-10-26T12:01:49Z","fixes":[{"ecosystem":"Debian:12","package":"tigervnc","fixed_in":["1.10.1+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tigervnc","fixed_in":["1.10.1+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tigervnc","fixed_in":["1.10.1+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"tigervnc","fixed_in":["1.7.0+dfsg-7+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"tigervnc","fixed_in":["1.10.1-1.2.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-debuginfo","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-debugsource","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-icons","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-license","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-selinux","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-debuginfo","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-minimal","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-minimal-debuginfo","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-module","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-module-debuginfo","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tigervnc","fixed_in":["0:1.11.0-6.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"tigervnc","fixed_in":["1.9.0-19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"tigervnc","fixed_in":["1.9.0-19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"tigervnc","fixed_in":["1.9.0-19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"tigervnc","fixed_in":["1.9.0-19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tigervnc","fixed_in":["1.6.0-22.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tigervnc","fixed_in":["1.8.0-13.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tigervnc","fixed_in":["1.8.0-13.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tigervnc","fixed_in":["1.8.0-13.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tigervnc","fixed_in":["1.8.0-13.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"tigervnc","fixed_in":["1.6.0-27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tigervnc","fixed_in":["1.10.1+dfsg-3ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tigervnc","fixed_in":["1.9.0-lp152.7.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tigervnc","fixed_in":["1.9.0-lp151.4.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0+dfsg-7+deb9u2"}]}],"versions":["1.7.0+dfsg-7","1.7.0+dfsg-7+deb9u1"]},{"source":"osv","ecosystem":"Mageia:7","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.2.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-icons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tigervnc-server-module-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-6.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-22.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-13.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-13.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-13.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-13.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-27.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+dfsg-7ubuntu1","1.7.0+dfsg-8ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-3ubuntu0.1+esm2"}]}],"versions":["1.9.0+dfsg-3","1.9.0+dfsg-4","1.10.1+dfsg-1","1.10.1+dfsg-2","1.10.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-3ubuntu0.1+esm2"}]}],"versions":["1.9.0+dfsg-3","1.9.0+dfsg-4","1.10.1+dfsg-1","1.10.1+dfsg-2","1.10.1+dfsg-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-lp152.7.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-lp151.4.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-17.1"}]}],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"tigervnc","product":"tigervnc"}],"references":[{"url":"https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=1176733","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26117","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cx25-8g49-fx7q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26117","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27270","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XJC7PGEFEUUZTWSX7CGQG5YLB3NCQ6BO/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2396","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1783","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897504","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1783.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-26117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26117","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1783","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202880-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176733","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26117","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202881-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202882-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202898-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-26117","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5965-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XS5VNPUJXC4RVE5YZN63OGFZP4VKDS5B/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AHGUGM3YL5HL5VFJ4H6Q3GAZOZUQSECF/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15695","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26117","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T03:30:25Z","modified":"2024-08-04T15:49:07.161Z","updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2020-18747","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T03:30:25Z","modified":"2024-08-04T15:49:07Z","updated_at":"2026-11-03T03:07:15.778249Z"}],"ghsa":[{"id":"GHSA-cx25-8g49-fx7q","title":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle...","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2022-05-24T17:29:42Z","modified":"2023-01-28T05:03:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:43:53.587553Z"}],"nvd":[{"id":"CVE-2020-26117","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T04:15:11.65Z","modified":"2026-06-17T03:07:37.717Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-26117","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T04:15:11.65Z","modified":"2026-10-20T13:59:19.46496787Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-26117","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T04:15:11.65Z","modified":"2026-10-26T12:01:49.03807041Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"RHSA-2021:1783","title":"Red Hat Security Advisory: tigervnc security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:56:58Z","modified":"2025-11-22T12:20:19Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1783","title":"Moderate: tigervnc security, bug fix, and enhancement update","description":"Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.\n\nThe following packages have been upgraded to a later upstream version: tigervnc (1.11.0). (BZ#1880985)\n\nSecurity Fix(es):\n\n* tigervnc: certificate exceptions stored as authorities (CVE-2020-26117)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:04:56Z","modified":"2026-02-05T01:30:09.465851Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-26117","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.","status":"published","published":"2020-09-27T04:15:00Z","modified":"2026-02-04T23:58:43.089443Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2396-1","title":"tigervnc - security update","status":"published","published":"2020-10-06T00:00:00Z","modified":"2026-03-09T01:21:16.036028Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0388","title":"Updated tigervnc packages fix a security vulnerability","description":"In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0,\nviewers mishandle TLS certificate exceptions. They store the certificates as\nauthorities, meaning that the owner of a certificate could impersonate any\nserver after a client had added an exception. (CVE-2020-26117)\n","status":"published","published":"2020-10-20T16:22:12Z","modified":"2026-04-16T04:44:39.297794104Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1666-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-10-13T08:25:36Z","modified":"2026-02-04T02:34:45.198929Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1841-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-11-05T19:25:49Z","modified":"2026-02-04T04:26:28.178092Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10591-1","title":"libXvnc-devel-1.10.1-17.1 on GA media","description":"These are all security issues fixed in the libXvnc-devel-1.10.1-17.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:49.475111Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:2880-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733)\n","status":"published","published":"2020-10-09T12:43:23Z","modified":"2026-02-04T02:14:18.918118Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2881-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733)\n","status":"published","published":"2020-10-09T12:43:55Z","modified":"2026-02-04T02:28:37.367561Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2882-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733)\n","status":"published","published":"2020-10-09T12:44:33Z","modified":"2026-02-04T02:28:37.545776Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2898-1","title":"Security update for tigervnc","description":"This update for tigervnc fixes the following issues:\n\n- CVE-2020-26117: Server certificates were stored as certiticate\n  authorities, allowing malicious owners of these certificates\n  to impersonate any server after a client had added an exception\n  (bsc#1176733).\n","status":"published","published":"2020-10-13T12:17:24Z","modified":"2026-02-04T04:21:34.936129Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5965-1","title":"tigervnc vulnerability","description":"It was discovered that TigerVNC mishandled TLS certificate exceptions. An\nattacker could use this vulnerability to impersonate any server after a client\nhad added an exception and obtain sensitive information.\n","status":"published","published":"2023-03-21T01:41:15Z","modified":"2026-04-27T16:36:28.57576Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}