Lucene search

K
freebsdFreeBSD6190C0CD-B945-11EA-9401-2DCF562DAA69
HistoryJun 27, 2020 - 12:00 a.m.

PuTTY -- Release 0.74 fixes two security vulnerabilities

2020-06-2700:00:00
vuxml.freebsd.org
38

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

71.7%

Simon Tatham reports:

[Release 0.74] fixes the following security issues:
New configuration option to disable PuTTY’s default policy of
changing its host key algorithm preferences to prefer keys it
already knows. (There is a theoretical information leak in this
policy.) [CVE-2020-14002]
In some situations an SSH server could cause PuTTY to access freed
mdmory by pretending to accept an SSH key and then refusing the
actual signature. It can only happen if you’re using an SSH agent.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchputty< 0.74UNKNOWN
FreeBSDanynoarchputty-gtk2< 0.74UNKNOWN
FreeBSDanynoarchputty-nogtk< 0.74UNKNOWN

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

71.7%