{"id":"MGASA-2024-0003","summary":"Updated putty package fixes a security vulnerability (Terrapin attack)","details":"The SSH transport protocol with certain OpenSSH extensions, found in\nOpenSSH before 9.6 and many other products, allows remote attackers to\nbypass integrity checks such that some packets are omitted (from the\nextension negotiation message), and a client and server may consequently\nend up with a connection for which some security features have been\ndowngraded or disabled, aka a Terrapin attack. This occurs because the\nSSH Binary Packet Protocol (BPP), implemented by these extensions,\nmishandles the handshake phase and mishandles use of sequence numbers.\nThis update fixes putty.\n","modified":"2026-04-16T00:09:06.276568568Z","published":"2024-01-08T10:12:44Z","upstream":["CVE-2023-48795"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2024-0003.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=32672"}],"affected":[{"package":{"name":"putty","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/putty?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.80-1.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2024-0003.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}