This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Putty First view 2019-03-21
Product Putty Last view 2020-06-29
Version 0.70 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:putty:putty

Activity : Overall

Related : CVE

  Date Alert Description
5.9 2020-06-29 CVE-2020-14002

PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).

7.5 2019-10-01 CVE-2019-17069

PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.

7.5 2019-10-01 CVE-2019-17068

PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.

9.8 2019-10-01 CVE-2019-17067

PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection.

9.8 2019-03-21 CVE-2019-9898

Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.

7.5 2019-03-21 CVE-2019-9897

Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.

7.8 2019-03-21 CVE-2019-9896

In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.

9.8 2019-03-21 CVE-2019-9895

In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.

7.5 2019-03-21 CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

CWE : Common Weakness Enumeration

%idName
33% (3) CWE-20 Improper Input Validation
11% (1) CWE-770 Allocation of Resources Without Limits or Throttling
11% (1) CWE-327 Use of a Broken or Risky Cryptographic Algorithm
11% (1) CWE-320 Key Management Errors
11% (1) CWE-200 Information Exposure
11% (1) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
11% (1) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')