Critical Vulnerability in PuTTY: Potential Random Number Recycling
Summary
ALPINE-CVE-2019-9898: Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. Affects putty versions < 0.71-r0. Fixed in 0.71-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PuTTY is a widely used open-source terminal emulator, serial console, and network file transfer application. It supports various network protocols, including SSH, Telnet, and SCP, and is known for its versatility and security features. However, it has been found to have a critical vulnerability that affects its cryptographic functions, specifically related to the recycling of random numbers used in cryptography.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9898, arises from potential recycling of random numbers used in cryptography within PuTTY versions prior to 0.71. This flaw can lead to severe security implications, including the possibility of attackers predicting cryptographic keys, which could compromise secure communications and data integrity. The vulnerability has a CVSS score of 9.8, indicating its critical nature.
How To Fix
Minimum fixed version
0.71-r0
This is the first release that contains the fix.
sudo apk add --upgrade puttyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using affected versions of PuTTY for sensitive operations until they can update to the patched version. Additionally, consider using alternative secure communication tools until the update is applied.
Conclusion
The vulnerability CVE-2019-9898 in PuTTY poses a significant risk due to potential random number recycling in cryptographic processes. Users are strongly encouraged to update to version 0.71 or later to ensure their communications remain secure. For real-time monitoring of vulnerabilities, consider using Vulert, which can alert you to open-source vulnerabilities in your software without requiring code access.
See every vulnerability recorded for putty →
FAQ
CVE-2019-9898 is a critical vulnerability in PuTTY that involves the potential recycling of random numbers used in cryptography, which can compromise secure communications.
You can check if your version of PuTTY is affected by visiting the Vulert playground at Vulert Scanner, where you can analyze your application without needing to sign up.
The risks include the potential for attackers to predict cryptographic keys, leading to unauthorized access to secure communications and data breaches.
Yes, a patch is available in version 0.71 of PuTTY. Users are advised to update to this version or later to mitigate the vulnerability.
If you cannot update immediately, avoid using affected versions for sensitive operations and consider using alternative secure communication tools.
References
Related vulnerabilities
Recent vulnerabilities recorded for putty.
