To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), PuTTy recently issued security vulnerability about ECDSA private key. Attackers can exploit this vulnerability to restore the private key from signed messages and public key. When they have the private key, they can forge the signature and log in to any servers using that private key.

• Please update to PuTTy  0.80 later, FileZilla 3.66.5 later, WinSCP 6.3.2 later, TortoiseGit 2.15.0 later and TortoiseSVN 1.14.6 later.

For more details, please refer to:
https://bugzilla.redhat.com/show_bug.cgi?id=2275183
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office