CVE-2021-36367: High severity putty vulnerability
Published Jul 9, 2021
·Updated
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
Affected Software
3 affected componentsFixes available
debian/putty<=0.63-10+deb8u1, <=0.75-2, <=0.63-10
0.75-30.74-1+deb11u1
debian/putty<=0.70-6, <=0.74-1
0.74-1+deb11u10.78-20.78-2+deb12u10.80-1
Putty PuTTY<=0.75
Remediation
Event History
Jul 9, 2021
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-36367.
2
What is the severity of CVE-2021-36367?
The severity of CVE-2021-36367 is high (8.1).
3
What software is affected by CVE-2021-36367?
PuTTY version 0.75 is affected by CVE-2021-36367.
4
How does CVE-2021-36367 affect PuTTY?
CVE-2021-36367 allows for an attacker-controlled SSH server to present a spoofed authentication prompt and capture credential data.
5
Are there any references available for CVE-2021-36367?
Yes, you can find more information about CVE-2021-36367 in the references section.