Upstream information
Description
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 6.4 |
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | Partial |
| National Vulnerability Database | |
|---|---|
| Base Score | 7.5 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | None |
| Integrity Impact | High |
| Availability Impact | None |
| CVSSv3 Version | 3 |
SUSE Security Advisories:
- openSUSE-SU-2019:1113-1, published Fri Dec 8 15:48:41 2023
- openSUSE-SU-2019:1123-1, published Fri Dec 8 15:48:26 2023
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Package Hub 15 |
| Patchnames: openSUSE-2019-1123 |
| openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-1113 |
SUSE Timeline for this CVE
CVE page created: Fri Mar 22 07:50:16 2019CVE page last modified: Fri Dec 8 17:20:33 2023