Updated nettle packages fix security vulnerabilities

Remote crash in RSA decryption via manipulated ciphertext CVE-2021-3580. A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with...

Important: nettle

Issue Overview: A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an...

Incorrect Signature Verification

nettle uses incorrect signature verification. Some flaws in Several Nettle signature verification functions GOST DSA, EDDSA & ECDSA allows an attacker to force an invalid signature, causing an assertion failure or possible validation...

CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

DEBIAN-CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

Design/Logic Flaw

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

CVE-2021-20305

CVE-2021-20305 affects Nettle prior to 3.7.2 where signature verification (GOST DSA, EDDSA, ECDSA) calls ECC multiply with out-of-range scalars, potentially producing incorrect results and allowing an attacker to force an invalid signature (leading to assertion failure or validation issues). Docu...

CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

CVE-2021-20305: Use of a Broken or Risky Cryptographic Algorithm

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

CVE-2021-20305

A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an...

PT-2021-3125

Name of the Vulnerable Software and Affected Versions Nettle versions prior to 3.7.2 Description A flaw was found in the Nettle signature verification functions, including GOST DSA, EDDSA, and ECDSA, where the Elliptic Curve Cryptography point multiply function is called with out-of-range scalers...

Information Disclosure

Libgcrypt is vulnerable to information disclosure. An attacker who learns the EdDSA session key can recover the long-term secret key...

PT-2025-11144

Name of the Vulnerable Software and Affected Versions: EdDSA-Java aka ed25519-java versions 0.3.0 and earlier Description: The implementation of EdDSA in EdDSA-Java exhibits signature malleability and does not satisfy the SUF-CMA property. This allows attackers to create new valid signatures...

Unspecified vulnerability in Binance tss-lib

Binance tss-lib is an open source implementation of the multi-party t, n threshold ECDSA Elliptic Curve Digital Signature Algorithm and EdDSA Edwards Curve Digital Signature Algorithm based on the Gennaro and Goldfeder CCS 2018 1. A security vulnerability exists in the keygen protocol...

[ASA-201912-3] crypto++: private key recovery

Arch Linux Security Advisory ASA-201912-3 ========================================= Severity: High Date : 2019-12-06 CVE-ID : CVE-2019-14318 Package : crypto++ Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-1046 Summary ======= The package crypto++ before versi...

Using Ed25519 signing keys for encryption

@Benjojo12 and I are building an encryption tool that will also support SSH keys as recipients, because everyone effectively already publishes their SSH public keys on GitHub. For RSA keys, this is dangerous but straightforward: a PKCS1 v1.5 signing key is the same as an OAEP encryption key...

USN-3347-1: Libgcrypt vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that Libgcrypt was susceptible to an attack...

Ubuntu: Security Advisory (USN-3347-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : Libgcrypt vulnerabilities (USN-3347-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3347-1 advisory. Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuva...