Branch p9 update bulletin.

Package putty updated to version 0.75-alt1 for branch p9 in task 271823.

Published: 2019-10-01
Modified: 2024-11-21

CVE-2019-17068

PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Published: 2019-10-01
Modified: 2024-11-21

CVE-2019-17069

PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2020-06-29
Modified: 2024-11-21

CVE-2020-14002

PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).

Severity: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Version: 2.1.0

Branch p9 update on 2021-05-27

ALT-BU-2021-3932-1

ALT-PU-2021-1860-1

Closed vulnerabilities

CVE-2019-17068

CVE-2019-17069

CVE-2020-14002