{"id":"CVE-2021-36367","details":"PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).","modified":"2026-03-15T22:37:24.480412Z","published":"2021-07-09T21:15:08.540Z","references":[{"type":"WEB","url":"https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5588"},{"type":"ADVISORY","url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36367.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.75"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}