In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-09-27T03:30:25
Updated: 2024-08-04T15:49:07.161Z
Reserved: 2020-09-27T00:00:00
Link: CVE-2020-26117
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2020-09-27T04:15:11.650
Modified: 2022-11-16T14:13:22.957
Link: CVE-2020-26117
Redhat