tldrdailynews.com logo

PuTTY SSH Client Vulnerability Enables Private Key Recovery

1 min read
Source: The Hacker News
PuTTY SSH Client Vulnerability Enables Private Key Recovery
Photo: The Hacker News
TL;DR

The widely-used PuTTY SSH client, along with other products like FileZilla, WinSCP, TortoiseGit, and TortoiseSVN, has been found vulnerable to a key recovery attack that could compromise NIST P-521 private keys. The flaw, assigned the CVE identifier CVE-2024-31497, allows attackers to recover private keys and forge signatures, potentially leading to unauthorized access to servers. The issue has been addressed in the latest versions of PuTTY, FileZilla, WinSCP, and TortoiseGit, with recommendations for users of TortoiseSVN to use the latest PuTTY release until a patch is available. Additionally, affected keys should be considered compromised and revoked.

Topics:technologyencryption-network-security#encryption#encryption-network-security#key-recovery-attack#putty#ssh#vulnerability
Share this article
  1. Widely-Used PuTTY SSH Client Found Vulnerable to Key Recovery Attack  The Hacker News
  2. PuTTY SSH client flaw allows recovery of cryptographic private keys  BleepingComputer
  3. Critical PuTTY Client Vulnerability Lets Attackers Recover Private Keys  CybersecurityNews
  4. Critical Crypto Bug Fixed in PuTTY | Decipher  Duo Security
  5. PuTTY vulnerability can be exploited to recover private keys (CVE-2024-31497)  Help Net Security

Want the full story? Read the original reporting

Read on The Hacker News