ArchLinux: 202106-28: nettle: denial of service | LinuxSecurity.com

Advisories

Arch Linux Security Advisory ASA-202106-28
==========================================

Severity: Medium
Date    : 2021-06-09
CVE-ID  : CVE-2021-3580
Package : nettle
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2052

Summary
=======

The package nettle before version 3.7.3-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 3.7.3-1.

# pacman -Syu "nettle>=3.7.3-1"

The problem has been fixed upstream in version 3.7.3.

Workaround
==========

None.

Description
===========

Multiple issues were found with Nettle's RSA decryption functions
before version 3.7.3. These can be triggered by providing manipulated
ciphertext and could lead to application crash and denial of service.
Since nettle is used with gnuTLS, there is a possibility that a remote
client could crash a server compiled with gnuTLS when RSA is used for
the initial key exchange.

Impact
======

A remote attacker could crash an application using Nettle with a
crafted RSA ciphertext.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1967983
https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1e087f4799edaefe
https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812fdb39cae4adf98c
https://security.archlinux.org/CVE-2021-3580

ArchLinux: 202106-28: nettle: denial of service

June 11, 2021
The package nettle before version 3.7.3-1 is vulnerable to denial of service

Summary

Multiple issues were found with Nettle's RSA decryption functions before version 3.7.3. These can be triggered by providing manipulated ciphertext and could lead to application crash and denial of service. Since nettle is used with gnuTLS, there is a possibility that a remote client could crash a server compiled with gnuTLS when RSA is used for the initial key exchange.

Resolution

Upgrade to 3.7.3-1.
# pacman -Syu "nettle>=3.7.3-1"
The problem has been fixed upstream in version 3.7.3.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1967983 https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1e087f4799edaefe https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812fdb39cae4adf98c https://security.archlinux.org/CVE-2021-3580

Severity
CVE-ID : CVE-2021-3580
Package : nettle
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-2052

Impact

A remote attacker could crash an application using Nettle with a crafted RSA ciphertext.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.