{"id":"CVE-2019-17068","aliases":["ALPINE-CVE-2019-17068","DEBIAN-CVE-2019-17068","EUVD-2019-7539","GHSA-4r38-38gx-5vr9","MGASA-2020-0003","UBUNTU-CVE-2019-17068","openSUSE-SU-2019:2276-1","openSUSE-SU-2019:2277-1","openSUSE-SU-2019:2292-1","openSUSE-SU-2024:11201-1"],"status":"published","title":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a...","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01806,"percentile":0.78719,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2019-10-01T16:55:28Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.65-2","0.66-1","0.66-2","0.66-3","0.66-4","0.67-1","0.67-2","0.67-3build0.16.04.1","0.67-3+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.70-1","0.70-2","0.70-3","0.70-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-lp150.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-lp151.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-bp151.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-bp151.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76-1.2"}]}],"bundled":3}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"putty","product":"putty"}],"references":[{"url":"https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20191127-0003/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17068"},{"url":"https://github.com/advisories/GHSA-4r38-38gx-5vr9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17068","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17068","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0003.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25760","tags":["report"]},{"url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-08/msg00170.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-10/msg00047.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17068","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SUQ5V2FJFJZ3GWTMWUOQ6WV4D5XRWHAW/#SUQ5V2FJFJZ3GWTMWUOQ6WV4D5XRWHAW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17069","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WGQXCGAAVNNA4DFZKQKPCPYSGKETWS2H/#WGQXCGAAVNNA4DFZKQKPCPYSGKETWS2H","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4OBK5AWJPTXQZNZMJBQZ4YQZZ2APFQED/#4OBK5AWJPTXQZNZMJBQZ4YQZZ2APFQED","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6542","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T16:55:28Z","modified":"2024-08-05T01:33:16.641Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2019-7539","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T16:55:28Z","modified":"2024-08-05T01:33:16Z","updated_at":"2026-11-03T02:40:31.468839Z"}],"ghsa":[{"id":"GHSA-4r38-38gx-5vr9","title":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a...","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2022-05-24T16:57:31Z","modified":"2023-01-28T05:07:12Z","updated_at":"2026-11-02T14:44:30.20469Z"}],"nvd":[{"id":"CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T17:15:10.527Z","modified":"2026-06-17T02:23:15.48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"ALPINE-CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T17:15:10.527Z","modified":"2026-11-03T06:32:29.657633393Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T17:15:10.527Z","modified":"2026-04-16T04:34:42.636266541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T17:15:10.527Z","modified":"2026-09-21T07:01:15.836443964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-17068","description":"PuTTY before 0.73 mishandles the \"bracketed paste mode\" protection mechanism, which may allow a session to be affected by malicious clipboard content.","status":"published","published":"2019-10-01T17:15:00Z","modified":"2025-10-24T04:47:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2020-0003","title":"Updated putty packages fix security vulnerabilities","description":"Updated putty package fixes security vulnerabilities:\n\nTwo separate vulnerabilities affecting the obsolete SSH-1 protocol, both\navailable before host key checking.\n\nVulnerability in all the SSH client tools (PuTTY, Plink, PSFTP, and PSCP)\nif a malicious program can impersonate Pageant.\n\nCrash in GSSAPI / Kerberos key exchange triggered if the server provided\nan ordinary SSH host key as part of the exchange.\n\nInsufficient handling of terminal escape sequences, that should delimit\nthe pasted data in bracketed paste mode (CVE-2019-17068).\n\nPossible information leak caused by SSH-1 disconnection messages\n(CVE-2019-17069).\n\nThe putty package has been updated to version 0.73, fixing theese issues\nand other bugs.\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:43:20.96976912Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2276-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n","status":"published","published":"2019-10-07T12:22:30Z","modified":"2026-02-04T03:22:12.288783Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2277-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n","status":"published","published":"2019-10-07T12:22:43Z","modified":"2026-02-04T03:48:23.039575Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2292-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-10-07T22:22:03Z","modified":"2026-02-04T02:18:03.457559Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11201-1","title":"putty-0.76-1.2 on GA media","description":"These are all security issues fixed in the putty-0.76-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:24.521628Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}