Advisory ROSA-SA-2021-1930

Software: nettle 2.7.1
OS: Cobalt 7.9

CVE-ID: CVE-2018-16869
CVE-Crit: MEDIUM.
CVE-DESC: An oracle attack based on a Bleichenbacher-type side-channel was discovered in the way nettle handles the final transformation of PKCS # 1 v1.5 data decrypted with RSA. An attacker who could run a process on the same physical core as the victim process could exploit this vulnerability to extract plaintext or in some cases downgrade any TLS connections to the vulnerable server.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2021-20305
CVE-Crit: HIGH
CVE-DESC: A flaw was discovered in Nettle in versions prior to 3.7.2 where several of Nettle’s signature verification functions (GOST DSA, EDDSA, and ECDSA) caused the elliptic curve cryptography (ECC) multiplication point function to be called with out. range scalers, which can lead to incorrect results. This flaw allows an attacker to force an invalid signature, resulting in an assertion failure or possible verification failure. The biggest threat of this vulnerability is to the confidentiality, integrity as well as availability of the system.
CVE-STATUS: default
CVE-REV: default