Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-33500
7.5
HIGHCVSS v3
Published
May 21, 2021
CVSS v2
5 MEDIUM
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.
PuTTY
ChocolateyPuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an `xterm` terminal emulator.
## Features
- Unicode support
- Control over the SSH encryption key and protocol version
- Command-line SCP and SFTP clients, called "pscp" and "psftp" respectively
- Control over port forwarding with SSH (local, remote or dynamic port forwarding), including built-in handling of X11 forwarding
- Emulates most xterm, VT102 control sequences, as well as much of ECMA-48 terminal emulation
- IP Version 6 support
- Supports 3DES, AES, Arcfour, Blowfish, DES
- Public-key authentication support
- Support for local serial port connections
## Components
- PuTTY: the Telnet, rlogin, and SSH client itself, which can also connect to a serial port
- PSCP: an SCP client, i.e. command-line secure file copy
- PSFTP: an SFTP client, i.e. general file transfer sessions much like FTP
- PuTTYtel: a Telnet-only client
- Plink: a command-line interface to the PuTTY back ends
- Pageant: an SSH authentication agent for PuTTY, PSCP and Plink
- PuTTYgen: an RSA, DSA, ECDSA and EdDSA key generation utility
- pterm: a standalone terminal emulator
## Notes
- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
- This meta package depends on [putty.portable](https://chocolatey.org/packages/putty.portable) rather than [putty.install](https://chocolatey.org/packages/putty.install) for historical reasons. Since this may violate expectation of certain users, consider installing the latter directly.
- Support for putty 64bit have been added to the package when running chocolatey 0.10.4+, to keep using 32bit version of putty please pass `--x86` when installing/upgrading `putty.install` *(64bit installation may fail if 32bit is already installed)*
- Use of PuTTY, PSCP, PSFTP and Plink is illegal in countries where encryption is outlawed.
- We believe it is legal to use PuTTY, PSCP, PSFTP and Plink in England and Wales and in many other countries, but we are not lawyers, and so if in doubt you should seek legal advice before downloading it.
- You may find useful information at [cryptolaw.org](http://www.cryptolaw.org/), which collects information on cryptography laws in many countries, but we can't vouch for its correctness.
ChocolateyPuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an `xterm` terminal emulator.
## Features
- Unicode support
- Control over the SSH encryption key and protocol version
- Command-line SCP and SFTP clients, called "pscp" and "psftp" respectively
- Control over port forwarding with SSH (local, remote or dynamic port forwarding), including built-in handling of X11 forwarding
- Emulates most xterm, VT102 control sequences, as well as much of ECMA-48 terminal emulation
- IP Version 6 support
- Supports 3DES, AES, Arcfour, Blowfish, DES
- Public-key authentication support
- Support for local serial port connections
## Components
- PuTTY: the Telnet, rlogin, and SSH client itself, which can also connect to a serial port
- PSCP: an SCP client, i.e. command-line secure file copy
- PSFTP: an SFTP client, i.e. general file transfer sessions much like FTP
- PuTTYtel: a Telnet-only client
- Plink: a command-line interface to the PuTTY back ends
- Pageant: an SSH authentication agent for PuTTY, PSCP and Plink
- PuTTYgen: an RSA, DSA, ECDSA and EdDSA key generation utility
- pterm: a standalone terminal emulator
## Notes
- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
- This meta package depends on [putty.portable](https://chocolatey.org/packages/putty.portable) rather than [putty.install](https://chocolatey.org/packages/putty.install) for historical reasons. Since this may violate expectation of certain users, consider installing the latter directly.
- Support for putty 64bit have been added to the package when running chocolatey 0.10.4+, to keep using 32bit version of putty please pass `--x86` when installing/upgrading `putty.install` *(64bit installation may fail if 32bit is already installed)*
- Use of PuTTY, PSCP, PSFTP and Plink is illegal in countries where encryption is outlawed.
- We believe it is legal to use PuTTY, PSCP, PSFTP and Plink in England and Wales and in many other countries, but we are not lawyers, and so if in doubt you should seek legal advice before downloading it.
- You may find useful information at [cryptolaw.org](http://www.cryptolaw.org/), which collects information on cryptography laws in many countries, but we can't vouch for its correctness.
NPM