CVE-2020-14002

PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information
leak in the algorithm negotiation. This allows man-in-the-middle attackers to
target initial connection attempts (where no host key for the server has been
cached by the client).

References:

https://lists.tartarus.org/pipermail/putty-announce/
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1852415
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14002
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-14002.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14002
https://lists.tartarus.org/pipermail/putty-announce/
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/

Bug ID	1173634
Summary	VUL-1: CVE-2020-14002: putty: Observable Discrepancy may lead to information leak in the algorithm negotiation
Classification	openSUSE
Product	openSUSE Distribution
Version	Leap 15.1
Hardware	Other
URL	https://smash.suse.de/issue/262537/
OS	Other
Status	NEW
Severity	Normal
Priority	P5 - None
Component	Security
Assignee	jengelh@inai.de
Reporter	atoptsoglou@suse.com
QA Contact	security-team@suse.de
Found By	Security Response Team
Blocker	---