PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14002
Reference (s):
- https://security.netapp.com/advisory/ntap-20200717-0003/
- FEDORA:FEDORA-2020-35442ce9b7
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/
- FEDORA:FEDORA-2020-f4dba093f1
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ/