Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia: 2021-0300 Moderate: Nettle Update for Remote Crash Issue

mageia
Calendar Grey June 29, 2021
Dist Mageia Esm H88
Enhanced nettle packages tackle remote vulnerabilities and safeguard against security risks in Mageia versions 7 and 8, starting from June 2021.
Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

Summary

Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580).
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation (CVE-2021-20305).
The Mageia 8 nettle package has been updated to version 3.7.3 and the Mageia 7 nettle package has been patched to fix these issues.

References

- https://bugs.mageia.org/show_bug.cgi?id=28800

- - - https://ubuntu.com/security/notices/USN-4906-1

- https://ubuntu.com/security/notices/USN-4990-1

- https://www.cve.org/CVERecord?id=CVE-2021-3580

- https://www.cve.org/CVERecord?id=CVE-2021-20305

Topics%20covered

Topics Covered

security advisory moderate security update cryptography remote crash Mageia Nettle

Resolution

SRPMS

- 8/core/nettle-3.7.3-1.mga8

- 7/core/nettle-3.4.1-1.1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 29 Jun 2021
URL: https://advisories.mageia.org/MGASA-2021-0300.html
Type: security
CVE: CVE-2021-3580, CVE-2021-20305

Topics%20covered

Topics Covered

security advisory moderate security update cryptography remote crash Mageia Nettle

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here