{"id":"CVE-2024-39917","aliases":["DEBIAN-CVE-2024-39917","DLA-4166-1","EUVD-2024-38299","GHSA-7w22-h4w7-8j5j","MGASA-2025-0044","SUSE-SU-2025:0335-1","SUSE-SU-2025:0336-1","SUSE-SU-2025:0350-1","UBUNTU-CVE-2024-39917","USN-8476-1","openSUSE-SU-2026:10816-1"],"status":"published","title":"xrdp allows an ininite number of login attempts","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00607,"percentile":0.49543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2024-07-12T15:24:01Z","modified":"2026-11-02T12:02:38Z","fixes":[{"ecosystem":"Debian:12","package":"xrdp","fixed_in":["0.9.21.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xrdp","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xrdp","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xrdp","fixed_in":["0.9.23.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xrdp","fixed_in":["0.9.10-3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xrdp","fixed_in":["0.9.10-3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xrdp","fixed_in":["0.9.13.1-150600.15.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xrdp","fixed_in":["0.9.13.1-150600.15.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xrdp","fixed_in":["0.9.13.1-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","fixed_in":["0.9.5-2ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","fixed_in":["0.9.12-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","fixed_in":["0.9.17-2ubuntu3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","fixed_in":["0.9.24-4ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1+deb12u1"}]}],"versions":["0.9.21.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1~deb11u2"}]}],"versions":["0.9.12-1.1","0.9.15-1","0.9.17-1","0.9.17-2","0.9.17-2.1","0.9.19-1","0.9.21.1-1~deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm3"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm2"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu3+esm2"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm3"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm2"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu3+esm2"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1build0.25.10.1"}]}],"versions":["0.10.1-3","0.10.1-3.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.27-2.1"}]}],"bundled":8}],"products":[{"vendor":"neutrinolabs","product":"xrdp"}],"references":[{"url":"https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-7w22-h4w7-8j5j","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/neutrinolabs/xrdp/commit/19c111c74c913ecc6e4ba9a738ed929a79d2ae8f","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00018.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39917.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39917","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-39917","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0044.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33985","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FMYGECEBC7XEBNQ2ZHXYRQBLCMHHXKP5/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250335-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227769","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39917","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250336-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250350-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-39917","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39917","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68670","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35512","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-39917","title":"xrdp allows an ininite number of login attempts","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. ","status":"published","published":"2024-07-12T15:24:01.307Z","modified":"2025-11-03T19:30:23.757Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-38299","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. ","status":"published","published":"2024-07-12T15:24:01Z","modified":"2025-11-03T19:30:23Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"nvd":[{"id":"CVE-2024-39917","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. ","status":"published","published":"2024-07-12T16:15:04.62Z","modified":"2026-06-17T07:43:01.293Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:10:12.994089Z"}],"osv":[{"id":"CVE-2024-39917","title":"xrdp allows an ininite number of login attempts","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. ","status":"published","published":"2024-07-12T15:24:01.307Z","modified":"2026-10-28T02:30:43.975210425Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-39917","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.","status":"published","published":"2024-07-12T16:15:04.62Z","modified":"2026-11-02T12:02:38.304538372Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-39917","description":"xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.","status":"published","published":"2024-07-12T16:15:00Z","modified":"2026-06-25T23:45:08.246798093Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"DLA-4166-1","title":"xrdp - security update","status":"published","published":"2025-05-16T00:00:00Z","modified":"2026-03-09T01:19:58.050706Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0044","title":"Updated xrdp packages fix security vulnerability","description":"xrdp allows an infinite number of login attempts. (CVE-2024-39917)\n","status":"published","published":"2025-02-08T02:23:00Z","modified":"2026-04-16T04:41:59.678960764Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2026:10816-1","title":"libpainter0-0.9.27-2.1 on GA media","description":"These are all security issues fixed in the libpainter0-0.9.27-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-05-20T08:00:21.273007125Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2025:0335-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)\n","status":"published","published":"2025-02-03T14:44:12Z","modified":"2026-02-04T02:46:20.170534Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0336-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)\n","status":"published","published":"2025-02-03T14:47:27Z","modified":"2026-02-04T03:36:41.88528Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0350-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)\n","status":"published","published":"2025-02-04T09:14:35Z","modified":"2026-02-04T02:28:05.890443Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-8476-1","title":"xrdp vulnerabilities","description":"It was discovered that xrdp incorrectly handled bounds checking when\nprocessing user domain information during the connection sequence. An\nunauthenticated remote attacker could use this issue to cause xrdp to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-68670)\n\nIt was discovered that xrdp did not correctly enforce the maximum number of\nlogin attempts configured by the MaxLoginRetry parameter. A remote attacker\ncould use this issue to perform an unlimited number of login attempts.\n(CVE-2024-39917)\n\nIt was discovered that xrdp did not perform bounds checking when accessing\nfont glyphs. Since some of this data is controllable by the user, a remote\nattacker could use this issue to cause xrdp to read out of bounds. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)\n\nIt was discovered that xrdp did not properly handle session establishment\nerrors. A remote attacker could use this issue to bypass OS-level session\nrestrictions enforced by PAM, such as the maximum number of concurrent\nsessions per user. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2023-40184)","status":"published","published":"2026-06-25T14:47:42Z","modified":"2026-06-25T23:59:17.105152448Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}