Mitigation Plan - Apache Guacamole - Protocol Agnostic Vulnerability.

[Jyotirmoy Sikdar <Jy...@tatacommunications.com.INVALID>]

Dear Team,

We come across from the forum that Apache Guacamole using Protocol Agnostic which is Security Weakened Protocol that allows vulnerabilities. Looking for detailed mitigation plan for have highly secured solution from your end to have our evaluation parameter fulfill.

Your suggestion is highly valuable for us.

[cid:image001.png@01DBB0A9.68E9B570]

Note: Is 'protocol agnostic' a feature? What does it mean?


Ref:
https://www.google.com/search?safe=active&sca_esv=72b01296a1b28e26&rlz=1C1GCEJ_enIN1092IN1092&sxsrf=AHTn8zoKrCAhUrtPuBXKIpOy1A0sITbwaw:1744987910771&q=Protocol+agnostic+risks+examples&sa=X&ved=2ahUKEwiIhbzE6uGMAxVaR2wGHWaTIUYQ1QJ6BAg-EAE&biw=1600&bih=732&dpr=1.2

https://www.infosecinstitute.com/resources/vulnerabilities/apache-guacamole-remote-desktop-protocol-rdp-vulnerabilities-what-you-need-to-know/

https://www.hipaajournal.com/serious-vulnerabilities-identified-in-apache-guacamole-remote-access-software/

https://www.cio.inc/apache-guacamole-vulnerable-to-reverse-rdp-vulnerabilities-a-14557

https://nvd.nist.gov/vuln/detail/CVE-2023-45814

https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/Certified-Symbolic-Transaction-full.pdf

Regards,
Jyotirmoy

Re: Mitigation Plan - Apache Guacamole - Protocol Agnostic Vulnerability.

[Michael Jumper <mj...@apache.org>]

On 4/18/25 9:13 AM, Jyotirmoy Sikdar wrote:
> Dear Team,
> 
> We come across from the forum that Apache Guacamole using Protocol 
> Agnostic which is Security Weakened Protocol that allows 
> vulnerabilities. Looking for detailed mitigation plan for have highly 
> secured solution from your end to have our evaluation parameter fulfill.
> 
> Your suggestion is highly valuable for us.
> 
> Note: Is 'protocol agnostic' a feature? What does it mean?

Hi Jyotirmoy,

It's unclear what you're referring to by "protocol agnostic 
vulnerability" and "security weakened protocol", and the links cited in 
your message are appear to be either quite old or not relevant to Guacamole.

Can you clarify what you're looking for?

FWIW, the place for security-related reports and questions is the 
(private) security@guacamole.apache.org list. The user@ list should 
*not* be used for such things. That said, I'm not sure that's what 
you're asking.

- Mike

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org