CVE-2022-39283: 
NixOS vulnerability analysis and mitigation

CVE-2022-39283 affects FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The vulnerability was discovered in October 2022 and affects all FreeRDP-based clients using the /video command line switch. FreeRDP server implementations are not affected. The issue was patched in version 2.8.1 (FreeRDP Release, GitHub Advisory).

The vulnerability allows FreeRDP clients to read uninitialized data when using the /video command line switch. The uninitialized data could then be decoded as audio/video and displayed to the user. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by NIST NVD, while GitHub rates it as 5.9 MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD).

When exploited, this vulnerability could allow a malicious server to cause FreeRDP clients to read and display uninitialized data, potentially exposing sensitive information (Debian Advisory).

The vulnerability can be exploited when a FreeRDP client connects to a malicious server while using the /video command line switch. The attack requires no user interaction or special privileges, though the attack complexity is rated as high by some sources (GitHub Advisory).

The primary mitigation is to upgrade to FreeRDP version 2.8.1 or later which contains the fix for this vulnerability. If upgrading is not immediately possible, users can work around the issue by not using the /video command line switch (GitHub Advisory).