Question regarding PuTTY version being used

Hi,

Does the public vulnerabilities of the PuTTY version being used by WinSCP are automatically applied to the WinSCP or only the public WinSCP CVEs are the applicable vulnerabilities per version?

Thanks,
Eyal

That's rather broad question. anyway, if there's a fix to a vulnerability of the PuTTY version used by WinSCP, we include the fix into WinSCP. In general.

Do you have a specific vulnerability in mind?

In regards to CVE-2019-9898, can you update if WinSCP versions that uses PuTTY with versions earlier than 0.71 are affected or whether it has its own mechanism for ensuring true randomness?

That issue is tracked here:
Issue 1729 – Security fixes from PuTTY 0.71

Thanks!