PT-2020-13830 · Simon Tatham+1 · Putty+1

Published 2020-06-29 · Updated 2024-04-25 · CVE-2020-14002

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PuTTY versions 0.68 through 0.73

Description The issue allows man-in-the-middle attackers to target initial connection attempts where no host key for the server has been cached by the client, due to an Observable Discrepancy leading to an information leak in the algorithm negotiation.

Recommendations For PuTTY versions 0.68 through 0.73, update to a version that contains a fix for this issue to prevent information leaks during algorithm negotiation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ALT-PU-2021-1774

ALT-PU-2021-1860

ALT-PU-2023-4867

CVE-2020-14002

DLA-3794-1

MGASA-2020-0358

MGASA-2021-0380

Affected Products

Alt Linux

Putty

References · 31

• https://osv.dev/vulnerability/MGASA-2020-0358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14002 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0380 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14002 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0358.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IRKUHQP6O6TGN64SI7PYCKHJT24Y2EY2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IRAC73KPNR4HKTRKJNLIZXCYIP6STUZN · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14002 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14002 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0380.html · Security Note
• https://osv.dev/vulnerability/DLA-3794-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-14002 · Vendor Advisory