CVE-2022-23477: 
xrdp vulnerability analysis and mitigation

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). A critical vulnerability (CVE-2022-23477) was discovered in versions prior to v0.9.21, involving a buffer overflow in the audinsendopen() function (GitHub Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) by NIST and 9.1 (Critical) by GitHub. The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requiring No privileges (PR:N) and No user interaction (UI:N). The scope is Unchanged (S:U), with High impact on both Integrity (I:H) and Availability (A:H) (NVD).

The buffer overflow vulnerability in the audinsendopen() function could allow attackers to cause memory corruption or execute arbitrary code. This could potentially lead to system compromise or denial of service (Ubuntu Security).

There are no known workarounds for this vulnerability. Users are strongly advised to upgrade to xrdp version 0.9.21 or later. Various Linux distributions have released security updates to address this issue, including Ubuntu and Debian (Debian Security, Ubuntu Security).