PuTTY SSH client flaw allows recovery of cryptographic private keys:
A vulnerability tracked as CVE-2024-31497 in PuTTY 0.68 through 0.80 could potentially allow ...
bleepingcomputer.com/news/security/putty-ssh-client-flaw-allows-recovery-of-cryptographic-private-keys/
Photo: bleepingcomputer.com · view article
P521 Key LeakPuTTY 0.68–0.80 (CVE-2024-31497): about 58 signatures can enable recovery of a P-521 private key.
Key FactsApr 16, 2024 · Reading time: ~45 sec.
Summary created with AI assistance · Source: bleepingcomputer.com
Summary created with AI assistance · Source: bleepingcomputer.com
- PuTTY versions 0.68–0.80 exhibit a bias in ECDSA nonce generation for the NIST P-521 curve due to a deterministic reduction method on certain Windows builds.
- Researchers reported that roughly 58 signatures collected from SSH logins or public Git commits can be used to reconstruct a P‑521 private key, and Pageant agent forwarding can expose locally generated signatures.
- Recovered private keys can grant unauthorized SSH access, allow forging commit signatures in a developer's name, and enable supply-chain compromise of impacted software projects.
- The flaw was fixed in PuTTY 0.81 by adopting RFC 6979; P‑521 keys created with the vulnerable releases are unsafe and several applications such as FileZilla, WinSCP and TortoiseGit were confirmed affected.
Brinkmann explained on X that attackers require 58 signatures to calculate a target's private key, which they can acquire either by collecting them from logins to an SSH server they control or is compromised, or from signed Git commits.— Marcus Brinkmann on X (explaining the 58-signature requirement for private key recovery)
Story Details
| Last Updated | |
| Total Articles | 1 |
Main Topics
software that is intentionally hostile, intrusive, or damaging to a computer or network
software program or group of programs designed for end-users
Similar to This
Previous
Misogyny - | "That's the glue that holds men together, right up to the middle of society"
morgenpost.de/politik/article413395060/frauenhass-das-ist-der-kitt-der-maenner-bis-in-die-mitte-der-gesellschaft.html
Social glue: Civic gathering in Gummersbach with many honors: Small silver and gold city medals were awarded at the Gummersbach civic gathering on Friday evening ...
ksta.de/region/oberberg/gummersbach/sozialer-kitt-buergertreff-in-gummersbach-mit-vielen-ehrungen-1393735
Can a Samsung phone replace my laptop for coding? Termux and DeX say yes: Git, SSH, and VS Code ran fine in DeX, but not Docker
androidpolice.com/can-samsung-phone-replace-laptop-for-coding-termux-dex-say-yes/
The fight against waste as the first piece of the puzzle for a red-green-red alliance
morgenpost.de/berlin/article413378199/kampf-gegen-muell-als-erster-kitt-fuer-ein-rot-gruen-rotes-buendnis.html
The New Stack Oct 08
OpenSSH 10.6 deliberately breaks two features in the name of security: OpenSSH 10.6 weakens SSH compression and rejects $ and in command-line usernames to close ...
thenewstack.io/openssh-breaks-compression-usernames/
Hackers exploit new MikroTik RouterOS flaws to hijack routers: Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to ...
bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
Cocaine in the Harz Mountains: Village policeman Koops hunts down unscrupulous dealers in "Harter Brocken"
braunschweiger-zeitung.de/kultur/article413041542/kokain-im-harz-dorfpolizist-koops-jagt-bei-harter-brocken-skrupellose-dealer.html
Critical VMware vCenter RCE flaw exploited for reverse SSH access: A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is ...
bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
In stunning display of stupid, secret CISA credentials found in public GitHub repo
arstechnica.com/information-technology/2026/05/in-stunning-display-of-stupid-secret-cisa-credentials-found-in-public-github-repo/
Knight Rider KITT Replica: Speeding Ticket in New York: A replica of the famous talking car KITT from the TV series with David Hasselhoff was allegedly caught ...
faz.net/aktuell/gesellschaft/kriminalitaet/knight-rider-kitt-nachbau-strafzettel-in-new-york-accg-200837764.html
I replaced PuTTY, Notepad++, and WinSCP with modern tools, and I wish I had sooner
xda-developers.com/replace-putty-notepad-winscp-with-modern-tools/
Proton Pass is getting folders, an SSH agent, and other features later this year: The Proton team has released a roadmap of features it plans to launch later ...
neowin.net/news/proton-pass-is-getting-folders-an-ssh-agent-and-other-features-later-this-year/
I replaced PuTTY, Notepad++, and WinSCP with modern tools, and I wish I had sooner
xda-developers.com/replace-putty-notepad-winscp-with-modern-tools/
I replaced PuTTY with a modern SSH client and managing my servers has never felt this smooth
xda-developers.com/replaced-putty-with-ssh-client-managing-servers-never-felt-smooth/
Asus urges factory resets and strong passwords following botnet breach: The company's guidance follows the discovery of a widespread botnet attack that has ...
techspot.com/news/108218-asus-urges-factory-resets-strong-passwords-following-botnet.html
Next