{"id":"CVE-2020-14002","aliases":["ALPINE-CVE-2020-14002","DEBIAN-CVE-2020-14002","DLA-3794-1","EUVD-2020-6169","GHSA-f25w-hjcw-x829","MGASA-2020-0358","MGASA-2021-0380","UBUNTU-CVE-2020-14002"],"status":"published","title":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the...","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03134,"percentile":0.87992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-203"],"published":"2020-06-29T00:00:00Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"putty","fixed_in":["0.74-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.74-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.74-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.74-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"putty","fixed_in":["0.74-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libfilezilla","fixed_in":["0.30.0-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"filezilla","fixed_in":["3.55.0-1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.68"},{"fixed":"0.74-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1+deb11u1~deb10u1"}]}],"versions":["0.70-6","0.71-1","0.72-1","0.72-2","0.73-1","0.73-2","0.73-3","0.74-1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libfilezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.55.0-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.65-2","0.66-1","0.66-2","0.66-3","0.66-4","0.67-1","0.67-2","0.67-3build0.16.04.1","0.67-3+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.70-1","0.70-2","0.70-3","0.70-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.72-1","0.73-1","0.73-2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"oncommand_unified_manager_core_package"},{"vendor":"putty","product":"putty"}],"references":[{"url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.tartarus.org/pipermail/putty-announce/","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200717-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14002"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ"},{"url":"https://lists.tartarus.org/pipermail/putty-announce"},{"url":"https://security.netapp.com/advisory/ntap-20200717-0003"},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients"},{"url":"https://github.com/advisories/GHSA-f25w-hjcw-x829"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14002","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14002","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0358.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26875","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0380.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29186","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IRKUHQP6O6TGN64SI7PYCKHJT24Y2EY2/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IRAC73KPNR4HKTRKJNLIZXCYIP6STUZN/","tags":["web"]},{"url":"https://filezilla-project.org/versions.php","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-14002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14002","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T00:00:00Z","modified":"2024-08-04T12:32:14.652Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6169","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T00:00:00Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.697348Z"}],"ghsa":[{"id":"GHSA-f25w-hjcw-x829","title":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the...","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2022-05-24T17:22:01Z","modified":"2024-05-05T05:02:46Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-203"],"updated_at":"2026-11-02T14:57:19.595262Z"}],"nvd":[{"id":"CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T18:15:11.767Z","modified":"2026-06-17T02:54:05.113Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ALPINE-CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T18:15:11.767Z","modified":"2026-11-03T06:32:23.727105604Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T18:15:11.767Z","modified":"2026-04-16T04:44:19.562357016Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T18:15:11.767Z","modified":"2026-10-26T12:00:40.894818209Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-14002","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2020-06-29T18:15:00Z","modified":"2025-10-24T04:48:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-3794-1","title":"putty - security update","status":"published","published":"2024-04-25T00:00:00Z","modified":"2026-03-09T01:19:59.551509Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2020-0358","title":"Updated putty package fixes security vulnerability","description":"PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information\nleak in the algorithm negotiation. This allows man-in-the-middle attackers to\ntarget initial connection attempts (where no host key for the server has been\ncached by the client) (CVE-2020-14002).\n","status":"published","published":"2020-09-02T08:01:16Z","modified":"2026-04-16T04:42:39.049145986Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"MGASA-2021-0380","title":"Updated filezilla packages fix security vulnerability","description":"filezilla embeds a PuTTY client that was vulnerable:\nPuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an\ninformation leak in the algorithm negotiation. This allows man-in-the-middle\nattackers to target initial connection attempts (where no host key for the \nserver has been cached by the client) (CVE-2020-14002).\n\nThe filezilla packages are updated to fix this issue to 3.55.0 version among\nother bugfixes since 3.51.0 we shipped in Mageia 8. See upstream release notes\nfor more informations.\n","status":"published","published":"2021-07-27T20:21:53Z","modified":"2026-04-16T04:41:54.916999842Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}