תיאור (מקור, אנגלית)
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
מוצרים מושפעים
nettle_project: nettle; fedoraproject: fedora; redhat: enterprise linux; netapp: active iq unified manager; netapp: ontap select deploy administration utility; debian: debian linux
קישורים10
- bugzilla.redhat.com/show_bug.cgi?id=1942533 Issue TrackingPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1942533 Issue TrackingPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/09/msg00008.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- security.gentoo.org/glsa/202105-31 Third Party Advisory
- security.netapp.com/advisory/ntap-20211022-0002/ Third Party Advisory
- www.debian.org/security/2021/dsa-4933 Third Party Advisory
- lists.debian.org/debian-lts-announce/2021/09/msg00008.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- security.gentoo.org/glsa/202105-31 Third Party Advisory
מדדים
- CVSS 3.1
-
8.1
HIGH
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 2% אחוזון 78 · נכון ל-6 בנובמבר 2026
- CWE
- CWE-327CWE-787
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.