CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the...
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
CVE-2020-14002- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
CVE-2020-14002- Updated
- 2026-11-02
EUVDEUVD-2020-6169 No score
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
EUVD-2020-6169- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f25w-hjcw-x829
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the...
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
GHSA-f25w-hjcw-x829- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-203
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
ALPINE-CVE-2020-14002- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
CVE-2020-14002- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
DEBIAN-CVE-2020-14002- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
- Record
UBUNTU-CVE-2020-14002- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0358 No score
Updated putty package fixes security vulnerability
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client) (CVE-2020-14002).
- Record
MGASA-2020-0358- Updated
- 2026-11-02
OSVMGASA-2021-0380 No score
Updated filezilla packages fix security vulnerability
filezilla embeds a PuTTY client that was vulnerable: PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client) (CVE-2020-14002).
The filezilla packages are updated to fix this issue to 3.55.0 version among other bugfixes since 3.51.0 we shipped in Mageia 8. See upstream release notes for more informations.
- Record
MGASA-2021-0380- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puttyAlpine:v3.10 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.11 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.12 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.13 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.14 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.15 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.16 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.17 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.18 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.19 |
0.68 up to 0.74-r0 | 0.74-r0 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
puttyAlpine:v3.20 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.21 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.22 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.23 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.24 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyAlpine:v3.9 |
0.68 up to 0.74-r0 | 0.74-r0 |
puttyDebian:12 |
before 0.74-1 | 0.74-1 |
puttyDebian:13 |
before 0.74-1 | 0.74-1 |
puttyDebian:14 |
before 0.74-1 | 0.74-1 |
puttyDebian:10 From an advisory covering 4 CVEs |
before 0.74-1+deb11u1~deb10u1, plus listed versions 0.70-60.71-10.72-10.72-20.73-10.73-20.73-30.74-1 |
0.74-1+deb11u1~deb10u1 |
puttyMageia:7 |
before 0.74-1.mga7 | 0.74-1.mga7 |
libfilezillaMageia:8 |
before 0.30.0-1.mga8 | 0.30.0-1.mga8 |
filezillaMageia:8 |
before 3.55.0-1.mga8 | 3.55.0-1.mga8 |
puttyUbuntu:16.04:LTS |
All versions, plus listed versions 0.65-20.66-10.66-20.66-30.66-4 Show 4 moreShow less0.67-10.67-20.67-3build0.16.04.10.67-3+deb9u1build0.16.04.1 |
None known |
puttyUbuntu:18.04:LTS |
All versions, plus listed versions 0.70-10.70-20.70-30.70-4 |
None known |
puttyUbuntu:20.04:LTS |
All versions, plus listed versions 0.72-10.73-10.73-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14002 is a medium vulnerability (CVSS 5.9) in Putty, published June 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 87th percentile. Fixed in putty 0.74-r0.
References
chiark.greenend.org.uk/~sgtatham/putty/changes.html
lists.tartarus.org/pipermail/putty-announce
fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV
security.netapp.com/advisory/ntap-20200717-0003
Show 17 moreShow less
lists.debian.org/debian-lts-announce/2024/04/msg00016.html
nvd.nist.gov/vuln/detail/CVE-2020-14002
github.com/advisories/GHSA-f25w-hjcw-x829
security.alpinelinux.org/vuln/CVE-2020-14002
security-tracker.debian.org/tracker/CVE-2020-14002
advisories.mageia.org/MGASA-2020-0358.html
bugs.mageia.org/show_bug.cgi?id=26875
filezilla-project.org/versions.php
ubuntu.com/security/CVE-2020-14002
cve.org/CVERecord?id=CVE-2020-14002