The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | debian-upgrade-nettle | Jul 30, 2024 | Feb 23, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-nettlehuawei-euleros-2_0_sp1-upgrade-nettle-devel | Nov 30, 2017 | Feb 23, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-nettleoracle-linux-upgrade-nettle-devel | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | redhat-upgrade-nettleredhat-upgrade-nettle-debuginforedhat-upgrade-nettle-devel | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | suse-upgrade-libhogweed2suse-upgrade-libhogweed2-32bitsuse-upgrade-libhogweed4suse-upgrade-libhogweed4-32bitsuse-upgrade-libnettle-develsuse-upgrade-libnettle4suse-upgrade-libnettle4-32bitsuse-upgrade-libnettle6suse-upgrade-libnettle6-32bit | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | ubuntu-upgrade-libnettle4ubuntu-upgrade-libnettle6 | Feb 23, 2016 | Feb 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub