CVE - CVE-2024-31497 (mitre.org)
PuTTY vulnerability vuln-p521-bias (greenend.org.uk)
summary: NIST P521 private keys are exposed by biased signature generation
class: vulnerability: This is a security vulnerability.
priority: high: This should be fixed in the next release.
absent-in: 0.67
present-in: 0.68 0.69 0.70 0.71 0.72 0.73 0.74 0.75 0.76 0.77 0.78 0.79 0.80
fixed-in: c193fe9848f50a88a4089aac647fecc31ae96d27 (0.81)
Hi Guysm
PuTTY Releases Security Update to Address Critical Vulnerability
PuTTY developers have warned of a critical vulnerability affecting versions 0.68 to 0.80. The flaw could allow an attacker to fully recover NIST-P521 private keys.
The vulnerability, CVE-2024-31497, stems from errors in ECDSA cryptographic number generation, enabling private key recovery. The discovery of the flaw is attributed to researchers Fabian Bäumer and Markus Brinkmann of Ruhr University Bochum.
The first 9 bits of each ECDSA nonce are zero, allowing for the complete recovery of the private key from approximately 60 signatures using state-of-the-art techniques.
A malicious actor possessing several dozen signed messages and a public key would have sufficient data to recover the private key and forge signatures, potentially leading to unauthorized access to servers and services that utilize this key.
The issue also affected other products integrated with vulnerable PuTTY versions:
- FileZilla (3.24.1 – 3.66.5)
- WinSCP (5.9.5 – 6.3.2)
- TortoiseGit (2.4.0.2 – 2.15.0)
- TortoiseSVN (1.10.0 – 1.14.6)
Following responsible disclosure, the issue has been addressed in new releases of PuTTY 0.81, FileZilla 3.67.0, WinSCP 6.3.3, and TortoiseGit 2.15.0.1.
Product developers have adopted the RFC 6979 technique to generate all DSA and ECDSA key types, abandoning the previous method. TortoiseSVN users are advised to utilize Plink from the latest PuTTY 0.81 release when accessing SVN repositories via SSH until an update is released.
NIST-P521 ECDSA keys used in any of the affected components should be considered compromised and immediately revoked by removing them from "~/.ssh/authorized_keys" and similar files on other SSH servers.
