The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | — | Upgrade nettle | Jul 30, 2024 | Feb 23, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade nettleUpgrade nettle-devel | Nov 30, 2017 | Feb 23, 2016 |
| Oracle_linux | — | Upgrade nettle-develUpgrade nettle | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | Upgrade nettleUpgrade nettle-develUpgrade nettle-debuginfo | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | Upgrade libnettle4-32bitUpgrade libhogweed2Upgrade libhogweed2-32bitUpgrade libhogweed4-32bitUpgrade libnettle6-32bitUpgrade libnettle6Upgrade libnettle-develUpgrade libhogweed4Upgrade libnettle4 | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | — | Upgrade libnettle6Upgrade libnettle4 | Feb 23, 2016 | Feb 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub