CVE-2020-14002
CVE-2020-14002
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
CVSS 5.9 · Medium · EPSS 3.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
putty Debian:12
- Affected ranges
- ECOSYSTEM: < 0.74-1
Update to 0.74-1
putty Debian:13
- Affected ranges
- ECOSYSTEM: < 0.74-1
Update to 0.74-1
putty Debian:14
- Affected ranges
- ECOSYSTEM: < 0.74-1
Update to 0.74-1
putty Ubuntu:16.04:LTS
- Versions
- 0.65-2
- 0.66-1
- 0.66-2
- 0.66-3
- 0.66-4
- 0.67-1
- 0.67-2
- 0.67-3build0.16.04.1
- 0.67-3+deb9u1build0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
putty Ubuntu:18.04:LTS
- Versions
- 0.70-1
- 0.70-2
- 0.70-3
- 0.70-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
putty Ubuntu:20.04:LTS
- Versions
- 0.72-1
- 0.73-1
- 0.73-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- https://lists.tartarus.org/pipermail/putty-announce/
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ/
- https://security.netapp.com/advisory/ntap-20200717-0003/
- https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-14002