nettle security update

2016-11-25T15:38:26
ID CESA-2016:2582
Type centos
Reporter CentOS Project
Modified 2016-11-25T15:38:26

Description

CentOS Errata and Security Advisory CESA-2016:2582

Nettle is a cryptographic library that is designed to fit easily in almost any context: In cryptographic toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like lsh or GnuPG, or even in kernel space.

Security Fix(es):

  • Multiple flaws were found in the way nettle implemented elliptic curve scalar multiplication. These flaws could potentially introduce cryptographic weaknesses into nettle's functionality. (CVE-2015-8803, CVE-2015-8804, CVE-2015-8805)

  • It was found that nettle's RSA and DSA decryption code was vulnerable to cache-related side channel attacks. An attacker could use this flaw to recover the private key from a co-located virtual-machine instance. (CVE-2016-6489)

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-cr-announce/2016-November/003375.html

Affected packages: nettle nettle-devel

Upstream details at: https://rhn.redhat.com/errata/RHSA-2016-2582.html