A flaw was found in Nettle in versions before 3.7.2 where several Nettle signature verification functions (GOST DSA EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality integrity as well as system availability.

🗓️ 10 Apr 2021 07:00:00Reported by MicrosoftType

Nettle flaw before 3.7.2 causes ECC scalar out-of-range in checks, risking invalid signatures.

Reporter	Title	Published	Views	Family All 214
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security has several security vulnerabilities addressed in the latest version	30 Jul 202107:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities (CVE-2020-25648, CVE-2021-31535, CVE-2021-20305, CVE-2020-25692)	8 Nov 202103:57	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Jazz Foundation and IBM Engineering products.	16 Jul 202117:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Verify Access	7 Jan 202200:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
ALT Linux	Security fix for the ALT Linux 9 package gnutls30 version 3.6.16-alt1	9 Jun 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package gnutls30 version 3.6.16-alt1	31 May 202100:00	–	altlinux
ATTACKERKB	CVE-2021-20305	5 Apr 202122:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : nettle (ALAS-2021-1629)	22 Apr 202100:00	–	nessus