CVE-2021-33500

PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
VendorProductVersion
puttyputty
𝑥
< 0.75
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
putty
bullseye
0.74-1+deb11u2
fixed
bullseye (security)
0.74-1+deb11u1
fixed
bookworm
0.78-2+deb12u2
fixed
bookworm (security)
0.78-2+deb12u1
fixed
sid
0.81-3
fixed
trixie
0.81-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
putty
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
References
https://docs.ssh-mitm.at/puttydos.html
https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.py
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://docs.ssh-mitm.at/puttydos.html
https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.py
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html