CVE-2020-26117
tigervnc: certificate exceptions stored as authorities
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 18, 2020
Updated · November 22, 2025
Description
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
This flaw can be mitigated by not making certificate exceptions in the affected versions of tigervnc, and therefore they will not be stored as authorities.
CVSS / CWE
CVSS 3.1 · 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-296 · Improper Following of a Certificate's Chain of Trust