{"id":"CVE-2019-9897","aliases":["ALPINE-CVE-2019-9897","DEBIAN-CVE-2019-9897","DLA-1763-1","DSA-4423-1","EUVD-2019-19253","GHSA-8428-8q8v-98pj","MGASA-2019-0153","UBUNTU-CVE-2019-9897","openSUSE-SU-2019:1113-1","openSUSE-SU-2019:1123-1"],"status":"published","title":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in...","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02939,"percentile":0.87202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-03-21T02:31:46Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"putty","fixed_in":["0.71-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.70-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.70-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.70-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"putty","fixed_in":["0.67-3+deb9u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.70-6"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-10+deb8u2"}]}],"versions":["0.63-10","0.63-10+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67-3+deb9u1"}]}],"versions":["0.67-3"],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"libfilezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"wxgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3.1-1.1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67-3+deb9u1build0.16.04.1"}]}],"versions":["0.65-2","0.66-1","0.66-2","0.66-3","0.66-4","0.67-1","0.67-2","0.67-3build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.70-1","0.70-2","0.70-3","0.70-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-lp150.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71-bp150.4.3.1"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"opensuse","product":"leap"},{"vendor":"putty","product":"putty"}],"references":[{"url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Apr/6","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190404-0001/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2019/dsa-4423","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9897"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES/"},{"url":"https://github.com/advisories/GHSA-8428-8q8v-98pj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9897","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9897","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0153.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24547","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LDO3F267P347E6U2IILFCYW7JPTLCCES/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TBPZ6RAMBOJAKKPJ54MPIPJTXNB2T6FW/","tags":["web"]},{"url":"https://trac.wxwidgets.org/ticket/17942","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-9897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9897","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CA2Q4AK5GQEYMMPK6PCTZM6P7CCCHSSH/#CA2Q4AK5GQEYMMPK6PCTZM6P7CCCHSSH","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1129633","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9898","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LGXV73N3N22CMABVEV6TXW4UHE243SBS/#LGXV73N3N22CMABVEV6TXW4UHE243SBS","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T02:31:46Z","modified":"2024-08-04T22:01:55.229Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19253","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T02:31:46Z","modified":"2024-08-04T22:01:55Z","updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-8428-8q8v-98pj","title":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in...","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2022-05-13T01:08:22Z","modified":"2023-02-01T05:03:17Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:02.739665Z"}],"nvd":[{"id":"CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T16:01:17.843Z","modified":"2026-06-17T02:44:48.66Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"ALPINE-CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T16:01:17.843Z","modified":"2026-11-03T06:32:23.264207176Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T16:01:17.843Z","modified":"2026-04-16T04:40:04.32037335Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T16:01:17.843Z","modified":"2026-09-21T07:03:26.790904428Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-9897","description":"Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.","status":"published","published":"2019-03-21T16:01:00Z","modified":"2025-10-24T04:47:35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1763-1","title":"putty - security update","status":"published","published":"2019-04-24T00:00:00Z","modified":"2026-03-09T01:18:34.037808Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4423-1","title":"putty - security update","status":"published","published":"2019-04-03T00:00:00Z","modified":"2026-03-09T02:10:02.025294Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0153","title":"Updated putty/filezilla/wxgtk packages fix security vulnerability","description":"A remotely triggerable memory overwrite in RSA key exchange in PuTTY before\n0.71 can occur before host key verification (CVE-2019-9894).\n\nIn PuTTY versions before 0.71 on Unix, a remotely triggerable buffer\noverflow exists in any kind of server-to-client forwarding (CVE-2019-9895).\n\nMultiple denial-of-service attacks that can be triggered by writing to the\nterminal exist in PuTTY versions before 0.71 (CVE-2019-9897).\n\nPotential recycling of random numbers used in cryptography exists within\nPuTTY before 0.71 (CVE-2019-9898).\n\nThe putty package has been updated to version 0.71 and the filezilla package\nhas been updated and patched to fix these issues.\n\nwxgtk has been updated to fix an assert when starting filezilla.\n","status":"published","published":"2019-05-07T21:38:09Z","modified":"2026-04-16T04:42:01.249039234Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1113-1","title":"Security update for putty","description":"This update for putty fixes the following issues:\n\nUpdate to new upstream release 0.71 [boo#1129633]\n\n* CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key\n  exchange, which can occur before host key verification\n  potential recycling of random numbers used in cryptography.\n* CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of\n  server-to-client forwarding.\n* CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered\n  by writing to the terminal.\n* CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography\n* CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable\n* Major rewrite of the crypto code to remove cache and timing\n  side channels.\n","status":"published","published":"2019-04-02T11:03:54Z","modified":"2026-02-04T03:55:11.287258Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1123-1","title":"Security update for putty","description":"This update for putty fixes the following issues:\n\nUpdate to new upstream release 0.71 [boo#1129633]\n\n* CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key\n  exchange, which can occur before host key verification\n  potential recycling of random numbers used in cryptography.\n* CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of\n  server-to-client forwarding.\n* CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered\n  by writing to the terminal.\n* CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography\n* CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable\n* Major rewrite of the crypto code to remove cache and timing\n  side channels.\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-04-02T13:58:36Z","modified":"2026-02-04T03:08:00.63337Z","updated_at":"2026-11-02T16:58:30.784344Z"}]}}