The vulnerability of signature verification functions (GOST DSA, EDDSA, and ECDSA) in the Nettle library, due to deficiencies in the cryptographic algorithms used, allows a perpetrator who has not undergone authentication verification to execute arbitrary code.

🗓️ 01 Jun 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Nettle signature verification for GOST DSA, EDDSA, and ECDSA enables unauthenticated code execution via bad signatures.

Reporter	Title	Published	Views	Family All 213
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security has several security vulnerabilities addressed in the latest version	30 Jul 202107:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities (CVE-2020-25648, CVE-2021-31535, CVE-2021-20305, CVE-2020-25692)	8 Nov 202103:57	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Jazz Foundation and IBM Engineering products.	16 Jul 202117:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Verify Access	7 Jan 202200:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
ALT Linux	Security fix for the ALT Linux 9 package gnutls30 version 3.6.16-alt1	9 Jun 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package gnutls30 version 3.6.16-alt1	31 May 202100:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : nettle (ALAS-2021-1629)	22 Apr 202100:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0029: gnutls and nettle (ALINUX3-SA-2021:0029)	14 May 202500:00	–	nessus

Vulners

Node

nettle nettleRange<3.7.2

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

canonical ubuntuMatch20.10

Source	Link
lists	www.lists.centos.org/pipermail/centos-announce/2021-April/048301.html
redos	www.redos.red-soft.ru/updatesec/
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2021041803
access	www.access.redhat.com/security/cve/cve-2021-20305
ubuntu	www.ubuntu.com/security/notices/USN-4906-1
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
altsp	www.altsp.su/obnovleniya-bezopasnosti/

19 Mar 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 27.6

CVSS 38.1

EPSS0.01491

nettle library signature verification weaknesses unauthenticated code execution bad signatures