PuTTY SSH Client Vulnerability Enables Private Key Recovery
TL;DR Summary
The widely-used PuTTY SSH client, along with other products like FileZilla, WinSCP, TortoiseGit, and TortoiseSVN, has been found vulnerable to a key recovery attack that could compromise NIST P-521 private keys. The flaw, assigned the CVE identifier CVE-2024-31497, allows attackers to recover private keys and forge signatures, potentially leading to unauthorized access to servers. The issue has been addressed in the latest versions of PuTTY, FileZilla, WinSCP, and TortoiseGit, with recommendations for users of TortoiseSVN to use the latest PuTTY release until a patch is available. Additionally, affected keys should be considered compromised and revoked.
Topics:technology#encryption#encryption-network-security#key-recovery-attack#putty#ssh#vulnerability
- Widely-Used PuTTY SSH Client Found Vulnerable to Key Recovery Attack The Hacker News
- PuTTY SSH client flaw allows recovery of cryptographic private keys BleepingComputer
- Critical PuTTY Client Vulnerability Lets Attackers Recover Private Keys CybersecurityNews
- Critical Crypto Bug Fixed in PuTTY | Decipher Duo Security
- PuTTY vulnerability can be exploited to recover private keys (CVE-2024-31497) Help Net Security
Reading Insights
Total Reads
0
Unique Readers
4
Time Saved
2 min
vs 3 min read
Condensed
78%
436 → 95 words
Want the full story? Read the original article
Read on The Hacker News