Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the Terrapin attack. This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. Details can be found at https://terrapin-attack.com/. For the oldstable distribution (bullseye), these problems have been fixed in version 0.74-1+deb11u1. This update includes a fix for CVE-2021-36367. For the stable distribution (bookworm), these problems have been fixed in version 0.78-2+deb12u1. We recommend that you upgrade your putty packages. For the detailed security status of putty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/putty
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
Terrapin attack
. This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/.
For the oldstable distribution (bullseye), these problems have been fixed in version 0.74-1+deb11u1. This update includes a fix for CVE-2021-36367.
For the stable distribution (bookworm), these problems have been fixed in version 0.78-2+deb12u1.
We recommend that you upgrade your putty packages.
For the detailed security status of putty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/putty
Vulmon