CVE-2020-13398

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "16.04"
                },
                {
                    "last_affected":  "16.04"
                },
                {
                    "introduced":  "18.04"
                },
                {
                    "last_affected":  "18.04"
                },
                {
                    "introduced":  "19.10"
                },
                {
                    "last_affected":  "19.10"
                },
                {
                    "introduced":  "20.04"
                },
                {
                    "last_affected":  "20.04"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "15.1"
                },
                {
                    "last_affected":  "15.1"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "opensuse:leap"
        }
    ]
}

References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type

GIT

Repo

https://github.com/freerdp/freerdp

Events

Introduced

Fixed

1923e63516c1182bd5e917aeac563431e8c5381a

Fixed

8305349a943c68b1bc8c158f431dc607655aadea

Fixed

8fb6336a4072abcee8ce5bd6ae91104628c7bb69

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.1.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0-beta1

1.0-beta2

1.0-beta4

1.0-beta5

1.0.0

1.0.1

1.1.0-beta+2013071101

1.1.0-beta1

1.1.0-beta1+android2

1.1.0-beta1+android3

1.1.0-beta1+android4

1.1.0-beta1+android5

1.1.0-beta1+ios1

1.1.0-beta1+ios2

1.1.0-beta1+ios3

1.1.0-beta1+ios4

1.2.0-beta1+android7

1.2.0-beta1+android9

2.*

2.0.0

2.0.0-beta1+android10

2.0.0-beta1+android11

2.0.0-rc0

2.0.0-rc1

2.0.0-rc2

2.0.0-rc3

2.0.0-rc4

2.1.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-13398.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "127549512390578125077878650666988322463",
            "length":  1286
        },
        "id":  "CVE-2020-13398-28dead16",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/freerdp/freerdp/commit/8305349a943c68b1bc8c158f431dc607655aadea",
        "target":  {
            "file":  "libfreerdp/crypto/crypto.c",
            "function":  "crypto_rsa_common"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "108360143611229333145035556397788799585",
                "267434929755811889333460073677970966612",
                "218501183778726424695857529119972091594",
                "79815481042191531532463771216528716794",
                "194581842354443939080333654740304363418",
                "229886005761293117432142611991489289552",
                "314536071681757153183378589567150535954",
                "333411006309431888694326942078202938810",
                "39794433047214326755713740973572280416",
                "181999607185193836239048006737466941917",
                "298470027794072186823956135920960869699",
                "86588292830267100537600810180648270451",
                "300505165883648502935549503689294166553",
                "301753431507414083162693297366083023114",
                "206585300347994937878549954786947211058",
                "320853604153239521437643937574117086845",
                "309036701507571958570063873341622125668",
                "122366048907736079773971143512142246929",
                "298694463024818382069506411535052718650",
                "74792263246576237359704274791111972494",
                "90448655921017157329122530072766984340"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-13398-93636d64",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/freerdp/freerdp/commit/8305349a943c68b1bc8c158f431dc607655aadea",
        "target":  {
            "file":  "libfreerdp/crypto/crypto.c"
        }
    }
]

vanir_signatures_modified

"2026-08-18T13:28:44Z"