MGASA-2021-0300
- Source
- https://advisories.mageia.org/MGASA-2021-0300.html
- Import Source
- https://advisories.mageia.org/MGASA-2021-0300.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2021-0300
- Related
- Published
- 2021-06-29T17:31:40Z
- Modified
- 2021-06-29T16:16:06Z
- Summary
- Updated nettle packages fix security vulnerabilities
- Details
-
Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580).
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation (CVE-2021-20305).
The Mageia 8 nettle package has been updated to version 3.7.3 and the Mageia 7 nettle package has been patched to fix these issues.
- References
-
- https://advisories.mageia.org/MGASA-2021-0300.html
- https://bugs.mageia.org/show_bug.cgi?id=28800
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009545.html
- https://ubuntu.com/security/notices/USN-4906-1
- https://ubuntu.com/security/notices/USN-4990-1
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:8 / nettle
Package
- Name
- nettle
- Purl
- pkg:rpm/mageia/nettle?distro=mageia-8
Mageia:7 / nettle
Package
- Name
- nettle
- Purl
- pkg:rpm/mageia/nettle?distro=mageia-7