logo
DATABASE RESOURCES PRICING ABOUT US

nettle security update

Description

**CentOS Errata and Security Advisory** CESA-2016:2582 Nettle is a cryptographic library that is designed to fit easily in almost any context: In cryptographic toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like lsh or GnuPG, or even in kernel space. Security Fix(es): * Multiple flaws were found in the way nettle implemented elliptic curve scalar multiplication. These flaws could potentially introduce cryptographic weaknesses into nettle's functionality. (CVE-2015-8803, CVE-2015-8804, CVE-2015-8805) * It was found that nettle's RSA and DSA decryption code was vulnerable to cache-related side channel attacks. An attacker could use this flaw to recover the private key from a co-located virtual-machine instance. (CVE-2016-6489) Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section. **Merged security bulletin from advisories:** https://lists.centos.org/pipermail/centos-cr-announce/2016-November/016265.html **Affected packages:** nettle nettle-devel **Upstream details at:** https://access.redhat.com/errata/RHSA-2016:2582


Affected Package


OS OS Version Package Name Package Version
CentOS 7 nettle 2.7.1-8.el7
CentOS 7 nettle 2.7.1-8.el7
CentOS 7 nettle-devel 2.7.1-8.el7
CentOS 7 nettle-devel 2.7.1-8.el7

Related