{"id":"CVE-2019-17069","aliases":["ALPINE-CVE-2019-17069","DEBIAN-CVE-2019-17069","DLA-3794-1","EUVD-2019-7540","GHSA-9fg2-hvwm-63r7","MGASA-2020-0003","UBUNTU-CVE-2019-17069","openSUSE-SU-2019:2276-1","openSUSE-SU-2019:2277-1","openSUSE-SU-2019:2292-1","openSUSE-SU-2024:11201-1"],"status":"published","title":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing...","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02248,"percentile":0.83141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-416"],"published":"2019-10-01T00:00:00Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"putty","fixed_in":["0.73-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.73-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1+deb11u1~deb10u1"}]}],"versions":["0.70-6","0.71-1","0.72-1","0.72-2","0.73-1","0.73-2","0.73-3","0.74-1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.65-2","0.66-1","0.66-2","0.66-3","0.66-4","0.67-1","0.67-2","0.67-3build0.16.04.1","0.67-3+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.70-1","0.70-2","0.70-3","0.70-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-lp150.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-lp151.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-bp151.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-bp151.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76-1.2"}]}],"bundled":3}],"products":[{"vendor":"netapp","product":"oncommand_unified_manager_core_package"},{"vendor":"opensuse","product":"leap"},{"vendor":"putty","product":"putty"}],"references":[{"url":"https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00020.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00021.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00030.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20191127-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17069"},{"url":"https://security.netapp.com/advisory/ntap-20191127-0003"},{"url":"https://github.com/advisories/GHSA-9fg2-hvwm-63r7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17069","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17069","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0003.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25760","tags":["report"]},{"url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-08/msg00170.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-10/msg00047.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17069","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SUQ5V2FJFJZ3GWTMWUOQ6WV4D5XRWHAW/#SUQ5V2FJFJZ3GWTMWUOQ6WV4D5XRWHAW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17069","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WGQXCGAAVNNA4DFZKQKPCPYSGKETWS2H/#WGQXCGAAVNNA4DFZKQKPCPYSGKETWS2H","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4OBK5AWJPTXQZNZMJBQZ4YQZZ2APFQED/#4OBK5AWJPTXQZNZMJBQZ4YQZZ2APFQED","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6542","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T00:00:00Z","modified":"2024-08-05T01:33:16.479Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7540","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T00:00:00Z","modified":"2024-08-05T01:33:16Z","updated_at":"2026-11-03T02:40:31.468839Z"}],"ghsa":[{"id":"GHSA-9fg2-hvwm-63r7","title":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing...","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2022-05-24T16:57:31Z","modified":"2024-04-26T00:30:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-416"],"updated_at":"2026-11-02T14:57:14.537163Z"}],"nvd":[{"id":"CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T17:15:10.573Z","modified":"2026-06-17T02:23:15.62Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"ALPINE-CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T17:15:10.573Z","modified":"2026-11-03T06:32:29.726593411Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T17:15:10.573Z","modified":"2026-04-16T04:31:24.107976427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T17:15:10.573Z","modified":"2026-09-21T07:03:06.182902973Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-17069","description":"PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.","status":"published","published":"2019-10-01T17:15:00Z","modified":"2025-10-24T04:47:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-3794-1","title":"putty - security update","status":"published","published":"2024-04-25T00:00:00Z","modified":"2026-03-09T01:19:59.551509Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2020-0003","title":"Updated putty packages fix security vulnerabilities","description":"Updated putty package fixes security vulnerabilities:\n\nTwo separate vulnerabilities affecting the obsolete SSH-1 protocol, both\navailable before host key checking.\n\nVulnerability in all the SSH client tools (PuTTY, Plink, PSFTP, and PSCP)\nif a malicious program can impersonate Pageant.\n\nCrash in GSSAPI / Kerberos key exchange triggered if the server provided\nan ordinary SSH host key as part of the exchange.\n\nInsufficient handling of terminal escape sequences, that should delimit\nthe pasted data in bracketed paste mode (CVE-2019-17068).\n\nPossible information leak caused by SSH-1 disconnection messages\n(CVE-2019-17069).\n\nThe putty package has been updated to version 0.73, fixing theese issues\nand other bugs.\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:43:20.96976912Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2276-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n","status":"published","published":"2019-10-07T12:22:30Z","modified":"2026-02-04T03:22:12.288783Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2277-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n","status":"published","published":"2019-10-07T12:22:43Z","modified":"2026-02-04T03:48:23.039575Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2292-1","title":"Security update for putty","description":"This update for putty to version 0.73 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753).\n- CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-10-07T22:22:03Z","modified":"2026-02-04T02:18:03.457559Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11201-1","title":"putty-0.76-1.2 on GA media","description":"These are all security issues fixed in the putty-0.76-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:24.521628Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}