The vulnerability of RSA decryption functions in the Nettle cryptographic library, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.

🗓️ 17 Jan 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 25 Views

Public-key decryption in the Nettle library has input validation flaws enabling crashes from crafted ciphertext.

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities found in open source code that is shipped with IBM Security Verify Governance, Identity Manager virtual appliance component	20 Jul 202215:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX Certified Container is affected by multiple vulnerabilities in Red Hat Universal Base Image version 8.4-206.1626828523 and Binutils version 2.30-93	14 Mar 202220:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from gzip, jackson-databind, libssh, gnutls, nettle and zlib	25 May 202214:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with Known Vulnerabilities	25 Apr 202214:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
attackerkb	CVE-2021-3580	5 Aug 202121:15	–	attackerkb
Tenable Nessus	AlmaLinux 8 : gnutls and nettle (ALSA-2021:4451)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : gnutls and nettle (CESA-2021:4451)	11 Nov 202100:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: gnutls / gnutls-c++ / gnutls-c++-debuginfo / gnutls-dane / etc Multiple Vulnerabilities (crlsa-2021_4451)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian DLA-2760-1 : nettle - LTS security update	19 Sep 202100:00	–	nessus

Vulners

Node

nettle nettleRange<3.7.3

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
git	www.git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1e087f4799edaefe
git	www.git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812fdb39cae4adf98c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3580
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-3580
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti

21 Nov 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25

CVSS 37.5

EPSS0.02708

Nettle library public key decryption input validation crafted ciphertext service crash