CVE-2021-20305: Use of a Broken or Risky Cryptographic Algorithm

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allow...

Linux Nettle 缓冲区错误漏洞

Linux Nettle is a Linux open source application. Contains a cryptographic library designed to fit easily into many situations at a low level. A buffer error vulnerability exists in Linux Nettle. The vulnerability stems from the Elliptic Curve Cryptographic Point ECC multiplication function being...

CVE-2021-20305

A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an...

FreeBSD : nettle 3.7.2 -- fix serious ECDSA signature verify bug (80f9dbd3-8eec-11eb-b9e8-3525f51429a0)

Niels Moller reports : I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp224...

[SECURITY] Fedora 34 Update: nettle-3.7.2-1.fc34

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

Fedora: Security Advisory for nettle (FEDORA-2021-dc225f3f65)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nettle 3.7.2 -- fix serious ECDSA signature verify bug

Niels Möller reports: I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp224r...

PT-2021-3125

Name of the Vulnerable Software and Affected Versions Nettle versions prior to 3.7.2 Description A flaw was found in the Nettle signature verification functions, including GOST DSA, EDDSA, and ECDSA, where the Elliptic Curve Cryptography point multiply function is called with out-of-range scalers...

dnsmasq security update

2.76-16.1 - Accept responses only on correct sockets CVE-2020-25684 - Use strong verification on queries CVE-2020-25685 - Handle multiple identical DNS queries better CVE-2020-25686 - Link against nettle for sha256 hash implementation...

PT-2021-27442

Name of the Vulnerable Software and Affected Versions: GnuTLS affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. Technical details about the crash include the involvement of specific functions such as gnutls mpi dprint size,...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2020-2371)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : nettle (EulerOS-SA-2020-2371)

According to the version of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS1 v1.5...

EulerOS Virtualization 3.0.2.2 : nettle (EulerOS-SA-2020-2206)

According to the version of the nettle package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2020-2206)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2020-2069)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : nettle (EulerOS-SA-2020-2069)

According to the version of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS1 v1.5...

OSV-2020-1595 Use-of-uninitialized-value in cryptofuzz::module::Nettle::OpSymmetricDecrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24785 Crash type: Use-of-uninitialized-value Crash state: cryptofuzz::module::Nettle::OpSymmetricDecrypt cryptofuzz::ExecutorBasecryptofuzz::Buffer, cryptofuzz::operation::SymmetricDec cryptofuzz::ExecutorBasecryptofuzz::Buffe...

PT-2020-21912

Name of the Vulnerable Software and Affected Versions Nettle affected versions not specified Description The issue is related to a crash caused by the use of an uninitialized value. It occurs in the cryptofuzz::module::Nettle::OpSymmetricDecrypt function, specifically during symmetric decryption...

cryptofuzz:cryptofuzz-openssl-noasm: Use-of-uninitialized-value in cryptofuzz::module::Nettle::OpSymmetricDecrypt

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5699479697883136 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type: Use-of-uninitialized-val...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2020-1752)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...