CVE-2019-9894: High severity Putty PuTTY vulnerability
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/puttyto a version that resolves this vulnerability.Fixed in 0.70-6Fixed in 0.74-1Fixed in 0.78-2Fixed in 0.79-1 - Upgrade
Upgrade
alpine/puttyto a version that resolves this vulnerability.Fixed in 0.71-r0
Event History
Frequently Asked Questions
What is CVE-2019-9894?
CVE-2019-9894 is a vulnerability in PuTTY before version 0.71 that allows for a remotely triggerable memory overwrite in the RSA key exchange process.
How does CVE-2019-9894 affect PuTTY?
CVE-2019-9894 affects PuTTY versions before 0.71, potentially leading to a memory overwrite in the RSA key exchange.
What is the severity of CVE-2019-9894?
The severity of CVE-2019-9894 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-9894?
PuTTY versions before 0.71 are affected by CVE-2019-9894.
How can I fix CVE-2019-9894?
To fix CVE-2019-9894, update PuTTY to version 0.71 or later.