{"id":"openSUSE-SU-2019:1985-1","aliases":[],"status":"published","title":"Recommended update for putty","description":"This update for putty fixes the following issues:\n\nUpdate to new upstream release 0.72 [boo#1144547, boo#1144548]\n\n* Fixed two separate vulnerabilities affecting the obsolete\n  SSH-1 protocol, both available before host key checking.\n* Fixed a vulnerability in all the SSH client tools (PuTTY,\n  Plink, PSFTP and PSCP) if a malicious program can impersonate\n  Pageant.\n* Fixed a crash in GSSAPI / Kerberos key exchange triggered if\n  the server provided an ordinary SSH host key as part of the\n  exchange.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-08-21T14:18:21Z","modified":"2019-08-21T14:18:21Z","fixes":[{"ecosystem":"openSUSE:Leap 15.0","package":"putty","fixed_in":["0.72-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"putty","fixed_in":["0.72-lp151.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.72-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.72-lp151.3.3.1"}]}]}],"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HGRTFQFMMVY222GSFFBHYYAOZ4AZFKOL/#HGRTFQFMMVY222GSFFBHYYAOZ4AZFKOL","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144547","tags":["report"]},{"url":"https://bugzilla.suse.com/1144548","tags":["report"]}],"sources":{"osv":[{"id":"openSUSE-SU-2019:1985-1","title":"Recommended update for putty","description":"This update for putty fixes the following issues:\n\nUpdate to new upstream release 0.72 [boo#1144547, boo#1144548]\n\n* Fixed two separate vulnerabilities affecting the obsolete\n  SSH-1 protocol, both available before host key checking.\n* Fixed a vulnerability in all the SSH client tools (PuTTY,\n  Plink, PSFTP and PSCP) if a malicious program can impersonate\n  Pageant.\n* Fixed a crash in GSSAPI / Kerberos key exchange triggered if\n  the server provided an ordinary SSH host key as part of the\n  exchange.\n","status":"published","published":"2019-08-21T14:18:21Z","modified":"2019-08-21T14:18:21Z","updated_at":"2026-11-02T16:58:30.784344Z"}]}}