Published: 05/04/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

A flaw was found in Nettle in versions prior to 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an malicious user to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nettle project nettle
redhat enterprise linux 7.0
redhat enterprise linux 8.0
fedoraproject fedora 33
netapp ontap select deploy administration utility -
netapp active iq unified manager -
debian debian linux 9.0
debian debian linux 10.0

Debian Bug report logs - #985652 libnettle8: New upstream version fixes ECDSA signature verification issue Package: libnettle8; Maintainer for libnettle8 is Magnus Holmgren <holmgren@debianorg>; Source for libnettle8 is src:nettle (PTS, buildd, popcon) Reported by: Andreas Metzler <ametzler@bebtde> Date: Sun, 21 Ma ...

Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...

Synopsis Important: Service Telemetry Framework 14 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 14 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which g ...

Multiple vulnerabilities were discovered in nettle, a low level cryptographic library, which could result in denial of service (remote crash in RSA decryption via specially crafted ciphertext, crash on ECDSA signature verification) or incorrect verification of ECDSA signatures For the stable distribution (buster), these problems have been fixed in ...

A flaw was found in Nettle, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results This flaw allows an attacker to force an invalid signature, causing an assertion fail ...

No description is available for this CVE ...

A security issue was found in Nettle, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results This flaw allows an attacker to force an invalid signature, causing an asse ...

Critical Infrastructure Sectors: Critical Manufacturing

AWS ECR Vulnerability Scan CLI

evs evs is CLI Tool for scainng AWS ECR Vulnerabilities Installation go install githubcom/jedipunkz/evs Requirement go 118 or later Scan Image $ evs scan --image testimage:latest --region ap-northeast-1 +----------------+--------+ | SEVERITY LEVEL | COUNTS | +----------------+--------+ | MEDIUM | 2 | | LOW |

CWE-787 https://bugzilla.redhat.com/show_bug.cgi?id=1942533 https://security.gentoo.org/glsa/202105-31 https://www.debian.org/security/2021/dsa-4933 https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html https://security.netapp.com/advisory/ntap-20211022-0002/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985652 https://nvd.nist.gov https://github.com/jedipunkz/evs https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10 https://www.debian.org/security/2021/dsa-4933

CVE-2021-20305

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect