CVE-2022-36436

Advisory

Vncauthproxy 1.2.0 includes a fix for CVE-2022-36436: Authentication bypass in RFB security handshake.
https://github.com/osuosl/twisted_vncauthproxy/pull/1

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----

* Fix CVE-2022-36436 - Authentication bypass in RFB security handshake
* Make timeout time configurable from the control port
* Add basic CI tests
* Add python_requires and set to not support 3.x
* Set ceilings which still support python2 for dependencies
* Update author to include OSUOSL catch-all
* Update project URL to github

Resources

• https://pypi.org/project/vncauthproxy
• https://pyup.io/changelogs/vncauthproxy/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36436
• https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b
• https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1
• https://pypi.org/project/VNCAuthProxy/
• https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/