The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | — | Upgrade nettle | Jul 30, 2024 | Feb 23, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade nettle-develUpgrade nettle | Nov 30, 2017 | Feb 23, 2016 |
| Oracle_linux | — | Upgrade nettleUpgrade nettle-devel | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | Upgrade nettle-develUpgrade nettleUpgrade nettle-debuginfo | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | Upgrade libnettle6Upgrade libhogweed4Upgrade libnettle6-32bitUpgrade libnettle-develUpgrade libhogweed2Upgrade libnettle4-32bitUpgrade libhogweed4-32bitUpgrade libnettle4Upgrade libhogweed2-32bit | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | — | Upgrade libnettle4Upgrade libnettle6 | Feb 15, 2016 | Feb 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub