Lucene search

K
mageiaGentoo FoundationMGASA-2021-0300
HistoryJun 29, 2021 - 8:31 p.m.

Updated nettle packages fix security vulnerabilities

2021-06-2920:31:40
Gentoo Foundation
advisories.mageia.org
15

0.01 Low

EPSS

Percentile

83.2%

Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580). A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation (CVE-2021-20305). The Mageia 8 nettle package has been updated to version 3.7.3 and the Mageia 7 nettle package has been patched to fix these issues.

OSVersionArchitecturePackageVersionFilename
Mageia7noarchnettle< 3.4.1-1.1nettle-3.4.1-1.1.mga7
Mageia8noarchnettle< 3.7.3-1nettle-3.7.3-1.mga8