csaf_bsi_cvd_white:bsi-2024-0001
CRITICAL CVSS 10.0 csaf_bsi_cvd_white
Description
The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.
Timeline
- Published
- 2024-04-15 19:00 UTC
- Last Modified
- 2024-04-15
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"acknowledgments": [
{
"names": [
"Fabian Bäumer",
"Marcus Brinkmann"
],
"organization": "Ruhr University Bochum",
"summary": "finding and reporting the vulnerability"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "As a content provider, BSI is responsible under general law for its own content distributed for use. However, it remains your responsibility to carefully check usage and/or implementation of information provided with the content.",
"title": "Legal disclaimer"
},
{
"category": "summary",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "Summary"
}
],
"publisher": {
"category": "coordinator",
"name": "Bundesamt für Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "BSI-2024-0001 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/bsi-2024-0001.json"
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client",
"tracking": {
"current_release_date": "2024-04-15T19:00:00.000Z",
"generator": {
"date": "2024-04-15T06:53:52.394Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.2"
}
},
"id": "BSI-2024-0001",
"initial_release_date": "2024-04-15T19:00:00.000Z",
"revision_history": [
{
"date": "2024-04-15T19:00:00.000Z",
"number": "1",
"summary": "Initial version."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": ">=0.68|<=0.80",
"product": {
"name": "PuTTY client 0.68 - 0.80",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.81",
"product": {
"name": "PuTTY client 0.81",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "PuTTY"
}
],
"category": "vendor",
"name": "PuTTY"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": ">=3.24.1|<=3.66.5",
"product": {
"name": "FileZilla Client 3.24.1 - 3.66.5",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "3.67.0",
"product": {
"name": "FileZilla Client 3.67.0",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "FileZilla Client"
}
],
"category": "vendor",
"name": "FileZilla"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": ">=5.9.5|<=6.3.2",
"product": {
"name": "WinSCP 5.9.5 - 6.3.2",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "6.3.3",
"product": {
"name": "WinSCP 6.3.3",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "WinSCP"
}
],
"category": "vendor",
"name": "WinSCP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": ">=2.4.0.2|<=2.15.0.0",
"product": {
"name": "TortoiseGit 2.4.0.2 - 2.15.0.0",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version",
"name": "2.15.0.1",
"product": {
"name": "TortoiseGit 2.15.0.1",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "TortoiseGit"
}
],
"category": "vendor",
"name": "TortoiseGit"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": ">=1.10.0|<=1.14.6",
"product": {
"name": "TortoiseSVN 1.10.0 - 1.14.6",
"product_id": "CSAFPID-0008"
}
},
{
"category": "product_version",
"name": "1.14.7",
"product": {
"name": "TortoiseSVN 1.14.7",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "TortoiseSVN"
}
],
"category": "vendor",
"name": "TortoiseSVN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-31497",
"cwe": {
"id": "CWE-334",
"name": "Small Space of Random Values"
},
"notes": [
{
"category": "description",
"text": "The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0010",
"CSAFPID-0007",
"CSAFPID-0009"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "CVE Record",
"url": "https://cveawg.mitre.org/api/cve/CVE-2024-31497"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 0.61.\nAdditionally, any key material using NIST P-521 must be revoke/discard and new keys have to be generated.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 3.67.0.",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://filezilla-project.org/download.php?type=client"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 6.3.3.",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://winscp.net/eng/download.php"
},
{
"category": "vendor_fix",
"date": "2024-04-15T19:00:00.000Z",
"details": "Update to the latest version of the product. At least version 2.15.0.1.",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://tortoisegit.org/download/"
},
{
"category": "workaround",
"date": "2024-04-15T19:00:00.000Z",
"details": "As long as there is no official patch available: Configure TortoiseSVN to use PuTTY's latest plink.exe instead of the included exe. ",
"product_ids": [
"CSAFPID-0008"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 10,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 10,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
},
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"temporalScore": 8.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0008"
]
}
],
"title": "Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client"
}
]
}