VDB

CVE-2024-31497

CVE-2024-31497 PUBLISHED CVSS 8.199999809265137 HIGH

The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.

EPSS 5.73% · 93.0th percentile

Risk Scores

CVSS 3.1
8.199999809265137
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score
5.73%
93.0th percentile

Affected Products

VendorProductVersions
FedoraFedora Linux
Citrix SystemsCitrix Systems XenServer
Citrix SystemsCitrix Systems Hypervisor
PuTTYPuTTY client 0.68 - 0.80
DebianDebian Linux
WinSCPWinSCP 5.9.5 - 6.3.2
FileZillaFileZilla Client 3.24.1 - 3.66.5
TortoiseGitTortoiseGit 2.4.0.2 - 2.15.0.0
TortoiseSVNTortoiseSVN 1.10.0 - 1.14.6
GentooGentoo Linux

Timeline

  • Apr 15, 2024 CVE Published
  • Apr 16, 2024 EPSS Score
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published
  • Apr 16, 2024 PoC Published

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›