important · Privilege
FreeRDP can leave active smart-card and generated private keys readable by another local account.
Affects
FreeRDP, an RDP client/server implementation and toolkit on Linux and other Unix-like systems.
Under a common 022 umask, private-key files could inherit permissions broad enough for another user on a shared Unix host to read an active temporary copy or traversable output file.
Detail and 3 sources
Generated PFX output could also use a public default password.
FreeRDP has published fixes for the affected workflows.