Back to Database
Status published
Medium
CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to...
Vulnerability Description
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-14002
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- https://lists.tartarus.org/pipermail/putty-announce/
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ/
- https://security.netapp.com/advisory/ntap-20200717-0003/
- https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html
More from putty
View All →CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even...
Unknown
0
CVE-2021-33500
PuTTY before 0.75 on Windows allows remote servers to cause...
High
7.5
CVE-2019-9898
Potential recycling of random numbers used in cryptography exists within...
Critical
9.8
CVE-2019-9897
Multiple denial-of-service attacks that can be triggered by writing to...
High
7.5
CVE-2019-9896
In PuTTY versions before 0.71 on Windows, local attackers could...
High
7.8
Affected Vendor
putty
View all reports →Affected Software
putty, oncommand unified manager core package, fedora
Vulnerable Versions:
0.68, 31, 32
Timeline
Official Publish:
June 29th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.