PT-2019-5479 · Simon Tatham+1 · Putty+1

Published 2019-03-21 · Updated 2021-07-21 · CVE-2019-9898

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PuTTY versions prior to 0.71

Description The issue is related to the potential recycling of random numbers used in cryptography within PuTTY. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with the use of an insufficiently reliable encryption algorithm.

Recommendations For versions prior to 0.71, update to version 0.71 or later to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Use of Insufficiently Random Values

Weakness Enumeration

CWE-327

CWE-330

Related Identifiers

BDU:2020-03218

CVE-2019-9898

DLA-1763-1

DSA-4423-1

MGASA-2019-0153

OPENSUSE-SU-2019:1113-1

OPENSUSE-SU-2019:1123-1

OPENSUSE-SU-2019_1113-1

Affected Products

Putty

Suse

References · 41

• https://ubuntu.com/security/CVE-2019-9898 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1113-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9898 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4423-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LDO3F267P347E6U2IILFCYW7JPTLCCES · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0153 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1123-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-9898 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9898 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03218 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-9898 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-9898 · Vendor Advisory
• https://debian.org/security/2019/dsa-4423 · Vendor Advisory