CVE-2021-36367: PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fc1ef8f35eaf642458b997fe736f7a02dc7659c1 commit fc1ef8f35eaf642458b997fe736f7a02dc7659c1 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2021-07-17 18:23:06 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2021-07-17 18:25:01 +0000 net-misc/putty: Security bump to version 0.76 Bug: https://bugs.gentoo.org/801517 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> net-misc/putty/Manifest | 1 + net-misc/putty/putty-0.76.ebuild | 95 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+)
amd64 stable
sparc stable
x86 stable
ppc done
ppc64 done all arches done
Please cleanup, thanks!
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c4567e7f8b564ed5da6a6b4da9fb443e4859a49 commit 4c4567e7f8b564ed5da6a6b4da9fb443e4859a49 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2021-07-26 06:59:12 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2021-07-26 06:59:32 +0000 net-misc/putty: Security cleanup Bug: https://bugs.gentoo.org/801517 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> net-misc/putty/Manifest | 1 - net-misc/putty/putty-0.75.ebuild | 95 ---------------------------------------- 2 files changed, 96 deletions(-)
Only exploitable via a malicious server - very low impact as users tend to trust the server they're connecting to. No GLSA. Sorry it took so long to get to this.
