Critical vulnerability in PuTTY exposes private keys

---

Critical vulnerability in PuTTY exposes private keys#### A serious vulnerability (CVE-2024–31497) has been discovered in the popular SSH client PuTTY (versions 0.68 to 0.80), affecting a wide range of software including FileZilla, WinSCP, TortoiseGit and TortoiseSVN.

This vulnerability drastically weakens the private keys used in the NIST P-521 curve ECDSA algorithm, making it easy for an attacker to recover them. The vulnerability was discovered by security researchers Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum.

This vulnerability compromises the private keys used in the ECDSA algorithm with the NIST P-521 curve so that an attacker can easily recover them. Attackers can exploit this flaw to reconstruct the private key.

Anyone using affected versions of PuTTY or related products such as Filezilla is vulnerable. Attackers can obtain the necessary signatures by briefly attacking the SSH server you are connecting to, or possibly from public sources where you have used the key (such as in Git).

This vulnerability affects not only PuTTY users, but also several other tools:  — FileZilla (versions 3.24.1–3.66.5)  — WinSCP (versions 5.9.5–6.3.2)  — TortoiseGit (version 2.4.0.2–2.15.0)  — TortoiseSVN (version 1.10.0–1.14.6)

**Vendor recommended: **1] Generate new keys: Generate new key pairs (ideally using the unaffected Ed25519 key) to replace the compromised keys.

2] Software update: Immediately update PuTTY to version 0.81 or higher. Do the same for FileZilla (version 3.67.0), WinSCP (version 6.3.3), TortoiseGit (version 2.15.0.1) and TortoiseSVN.