Lucene search

Gentoo FoundationMGASA-2021-0380

HistoryJul 27, 2021 - 11:21 p.m.

Updated filezilla packages fix security vulnerability

2021-07-2723:21:53

Gentoo Foundation

advisories.mageia.org

filezilla

putty

security vulnerability

3.55.0

information leak

algorithm negotiation

man-in-the-middle

cve-2020-14002

update

mageia 8

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

71.6%

JSON

filezilla embeds a PuTTY client that was vulnerable: PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client) (CVE-2020-14002). The filezilla packages are updated to fix this issue to 3.55.0 version among other bugfixes since 3.51.0 we shipped in Mageia 8. See upstream release notes for more informations.

OSVersionArchitecturePackageVersionFilename
Mageia8noarchlibfilezilla< 0.30.0-1libfilezilla-0.30.0-1.mga8
Mageia8noarchfilezilla< 3.55.0-1filezilla-3.55.0-1.mga8