Arch Linux Security Advisory ASA-202107-37 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36367 Package : putty Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2143 Summary ======= The package putty before version 0.76-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 0.76-1. # pacman -Syu "putty>=0.76-1" The problem has been fixed upstream in version 0.76. Workaround ========== None. Description =========== PuTTY before version 0.76 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user). Impact ====== A remote SSH server could present a spoofed authentication prompt. References ========== https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=1dc5659aa62848f0a... https://security.archlinux.org/CVE-2021-36367