x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | — | Upgrade nettle | Jul 30, 2024 | Feb 23, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade nettleUpgrade nettle-devel | Nov 30, 2017 | Feb 23, 2016 |
| Oracle_linux | — | Upgrade nettle-develUpgrade nettle | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | Upgrade nettle-debuginfoUpgrade nettle-develUpgrade nettle | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | Upgrade libhogweed4-32bitUpgrade libnettle6-32bitUpgrade libnettle-develUpgrade libhogweed4Upgrade libhogweed2Upgrade libnettle4-32bitUpgrade libhogweed2-32bitUpgrade libnettle4Upgrade libnettle6 | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | — | Upgrade libnettle4Upgrade libnettle6 | Feb 15, 2016 | Feb 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub