CVE-2021-20305
moderate-risk
Published 2021-04-05
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
Do I need to act?
-
0.18% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10
High
NETWORK
/ HIGH complexity
Affected Products (8)
Affected Vendors
References (12)
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1942533
Third Party Advisory
https://security.gentoo.org/glsa/202105-31
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0002/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4933
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1942533
Third Party Advisory
https://security.gentoo.org/glsa/202105-31
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0002/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4933
39
/ 100
moderate-risk
Severity
24/34 · High
Exploitability
1/34 · Minimal
Exposure
14/34 · Moderate