2021-07-19
ALT-BU-2021-4049-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Published: 2021-06-19
BDU:2021-04545
Уязвимость реализации протокола SSH средства криптографической защиты PuTTY, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: HIGH (8.1)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References:
Published: 2021-07-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References:
- https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa
- https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa
- [debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update
- [debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- DSA-5588
- DSA-5588
Closed bugs
Зависит от python3(PyQt5.QtWebKit) и python3(PyQt5.QtWebKitWidgets)