CVE-2021-20305

Katalog CVE

CVSS 8.1 · High EPSS 1,7%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada nettle project nettle, fedoraproject fedora +4 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Rincian

Terbit di NVD

5 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1942533 issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202105-31 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211022-0002/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4933 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7...