CVE-2021-36367

Aliases:DEBIAN-CVE-2021-36367ALPINE-CVE-2021-36367
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 09 Jul 2021, 00:00
Last modified:04 Aug 2024, 00:54

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
8.1 HIGH
v3.1 (cve.org)
EPSS Score
1.11% LOW
1% probability +0.97%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Jul 2021, 00:00
Published
Vulnerability first disclosed
04 Aug 2024, 00:54
Last Modified
Vulnerability information updated

Description

PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
  • v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 1.11%• Percentile: 64%

Techniques & Countermeasures

  • CWE-345•Insufficient Verification of Data Authenticity

    The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Systems

  • alpine•putty

    < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0 | < 0.76-r0

  • debian•putty

    < 0.74-1+deb11u1 | < 0.75-3 | < 0.75-3 | < 0.75-3

  • putty•putty

    ≤ 0.75

References (6)