CVE-2020-9498: Improper Restriction of Operations within the Bounds of a Memory Buffer

July 2, 2020 (updated July 21, 2021)

Apache Guacamole mishandles pointers involved in processing data received via RDP static virtual channels. If a user connects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.

References

nvd.nist.gov/vuln/detail/CVE-2020-9498

Code Behaviors & Features

Detect and mitigate CVE-2020-9498 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →