CVE-2019-17068

HIGH

PuTTY < 0.73 - Terminal Session Injection via Bracketed Paste Mode

Title source: llm

Description

PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.

References (5)

Core 5

Core References

Mailing List, Third Party Advisory x_refsource_misc

https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00020.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00021.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00030.html

Vendor Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20191127-0003/

Scores

CVSS v3 7.5

EPSS 0.0047

EPSS Percentile 64.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-74

Status published

Products (3)

opensuse/leap 15.0

opensuse/leap 15.1

putty/putty < 0.73

Published Oct 01, 2019

Tracked Since Feb 18, 2026