Advisories » MGASA-2021-0300

Updated nettle packages fix security vulnerabilities

Publication date: 29 Jun 2021
Modification date: 29 Jun 2021
Type: security
Affected Mageia releases : 7 , 8
CVE: CVE-2021-3580 , CVE-2021-20305

Description

Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580).

A flaw was found in Nettle in versions before 3.7.2, where several Nettle
signature verification functions (GOST DSA, EDDSA & ECDSA) result in the
Elliptic Curve Cryptography point (ECC) multiply function being called with
out-of-range scalers, possibly resulting in incorrect results. This flaw
allows an attacker to force an invalid signature, causing an assertion
failure or possible validation (CVE-2021-20305).

The Mageia 8 nettle package has been updated to version 3.7.3 and the Mageia 7
nettle package has been patched to fix these issues.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=28800
• https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html
• https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009545.html
• https://ubuntu.com/security/notices/USN-4906-1
• https://ubuntu.com/security/notices/USN-4990-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3580
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305

SRPMS

8/core

• nettle-3.7.3-1.mga8

7/core

• nettle-3.4.1-1.1.mga7