Red Hat Security AdvisoryRHSA-2016:2582
nettle security and bug fix update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) nettle-2.7.1-8.el7
- Red Hat Enterprise Linux Client Optional (v. 7) nettle-devel-2.7.1-8.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) nettle-2.7.1-8.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) nettle-devel-2.7.1-8.el7
- Red Hat Enterprise Linux Server (v. 7) nettle-2.7.1-8.el7, nettle-2.7.1-8.el7.ppc, nettle-devel-2.7.1-8.el7 +1
- Red Hat Enterprise Linux Workstation (v. 7) nettle-2.7.1-8.el7, nettle-devel-2.7.1-8.el7
Fixes 4 records
Priority MEDIUM 49
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified imp…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0398 · Published 2016-02-23 · Fixed CWE-254
Priority MEDIUM 49
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04247 · Published 2016-02-23 · Fixed CWE-254
Priority MEDIUM 47
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02814 · Published 2016-02-23 · Fixed CWE-310
Priority MEDIUM 41
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05048 · Published 2017-04-14 · Fixed CWE-203
THREATIST.IORead the docs