💵 Bounty: $1000 (details)

Feature Request

Original CVE report: https://www.openwall.com/lists/oss-security/2021/11/02/4

There are a few CVEs that affect Deskflow, as well as one SonarCloud hotspot:

• CVE-2021-42072
• CVE-2021-42073
• CVE-2021-42074
• CVE-2021-42075
• CVE-2021-42076
• SonarCloud hotspot: cpp:S5527 (Enable server hostname verification on this SSL/TLS connection)
• https://github.com/deskflow/deskflow/security/code-scanning/554

The fixes downstream need to be ported upstream. Except for SonarCloud hotspot: cpp:S5527, which may be fixed by one of the CVE fixes, or may need to be fixed as well. There is also this GitHub detected issue, but that appears to be the same as the SonarCloud issue: https://github.com/deskflow/deskflow/security/code-scanning/554

Related:

• Pentest to verify TLS CVE fixes #8010
• SonarCloud hotspot: cpp:S5527
• debauchee@229abab