CVE-2019-17069

moderate-risk
Published 2019-10-01

PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.

Do I need to act?

-
0.47% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Putty Netapp Opensuse

References (12)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00030.html
https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html
Mailing List https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20191127-0003/
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00030.html
https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html
Mailing List https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20191127-0003/
38
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 10/34 · Low