CVE-2020-14002MEDIUM
Description
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
References
https://lists.tartarus.org/pipermail/putty-announce/
https://security.netapp.com/advisory/ntap-20200717-0003/
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
Details
Source: MITRE
Published: 2020-06-29
Updated: 2020-07-17
Type: CWE-200
Risk Information
CVSS v2.0
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3.0
Base Score: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 2.2
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:* versions from 0.68 to 0.73 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 138244 | Fedora 31 : putty (2020-f4dba093f1) | Nessus | Fedora Local Security Checks | medium |
| 138235 | Fedora 32 : putty (2020-35442ce9b7) | Nessus | Fedora Local Security Checks | medium |
| 137870 | FreeBSD : PuTTY -- Release 0.74 fixes two security vulnerabilities (6190c0cd-b945-11ea-9401-2dcf562daa69) | Nessus | FreeBSD Local Security Checks | medium |