CVE-2017-2625: Red Hat Enterprise Linux

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

Affected products

• Red Hat Enterprise Linux: version 7.0 only
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.4 only
• Red Hat Enterprise Linux Server Eus: version 7.4 only; version 7.5 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• X.org Libxdmcp: before 1.1.2 (fixed in 1.1.2)

Published 2018-07-27. Last modified 2026-06-17.