CVE-2021-36367

PuTTY through 0.75 proceeds with establishing an SSH session even if it has
never sent a substantive authentication response. This makes it easier for
an attacker-controlled SSH server to present a later spoofed authentication
prompt (that the attacker can use to capture credential data, and use that
data for purposes that are undesired by the client user).

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990901&gt;