CVE-2024-31497
Fedoraproject Fedora 38 … 40
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-31497 is a medium-severity PRNG (CWE-338) vulnerability in Fedoraproject Fedora. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forge Web Credentials (T1606); ranked in the top 8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
In PuTTY versions 0.68 through 0.80, a flaw in ECDSA nonce generation for NIST P-521 keys enables recovery of the private key from roughly 60 signatures. The same biased-nonce issue is present in FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6. The vulnerability is tracked as CWE-338 and carries a CVSS 3.1 score of 5.9.
An attacker who obtains a modest set of signatures—either from publicly visible Git commits created through Pageant agent forwarding or by operating a malicious SSH server the victim connects to—can extract the P-521 private key. Once the key is recovered, the attacker can impersonate the victim against other services that accept the same key, including additional Git repositories where supply-chain modifications become possible.
Advisories and vendor notices direct users to upgrade PuTTY to 0.81 or later and to apply the corresponding fixed releases of the affected client tools. The references also highlight that previously collected signatures may already be sufficient for key recovery, so retrospective rotation of P-521 keys is recommended even if no further vulnerable versions are used.
The EPSS score sits at 0.2327 with no material upward movement after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29377
Vulnerability Data
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary…
more
is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forwarding mechanism. In other words, an adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions. After a key compromise, an adversary may be able to conduct supply-chain attacks on software maintained in Git. A second, independent scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. If the other services include Git services, then again it may be possible to conduct supply-chain attacks on software maintained in Git. This also affects, for example, FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V7.2.3V11.5.1
Mitigating Controls (NIST 800-53 r5) AI
Requiring specific approved cryptography for protection directly mandates use of strong PRNGs instead of weak ones.
Engineering principles applied during design and development include selection of cryptographically strong random number generation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.
Security testing can detect use of weak random number generators.
Secure SDLC processes should catch weak PRNG usage during design and code review.
Application security requirements can specify cryptographically strong random number generation.
Secure engineering principles include selection of appropriate cryptographic primitives.
Secure coding standards prohibit use of weak PRNGs in security contexts.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-338
RHEL 8 (1 rule)
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-338
Ubuntu 22.04 (1 rule)
- V-260650 Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-338