Lucene search

K
mageiaGentoo FoundationMGASA-2020-0003
HistoryJan 05, 2020 - 6:37 p.m.

Updated putty packages fix security vulnerabilities

2020-01-0518:37:51
Gentoo Foundation
advisories.mageia.org
10

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.007 Low

EPSS

Percentile

80.7%

Updated putty package fixes security vulnerabilities: Two separate vulnerabilities affecting the obsolete SSH-1 protocol, both available before host key checking. Vulnerability in all the SSH client tools (PuTTY, Plink, PSFTP, and PSCP) if a malicious program can impersonate Pageant. Crash in GSSAPI / Kerberos key exchange triggered if the server provided an ordinary SSH host key as part of the exchange. Insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (CVE-2019-17068). Possible information leak caused by SSH-1 disconnection messages (CVE-2019-17069). The putty package has been updated to version 0.73, fixing theese issues and other bugs.

OSVersionArchitecturePackageVersionFilename
Mageia7noarchputty< 0.73-1putty-0.73-1.mga7

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.007 Low

EPSS

Percentile

80.7%