A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nettle-develUpgrade gnutls-develUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-daneUpgrade nettle | May 4, 2022 | Apr 5, 2021 |
| Alpine Linux | — | Upgrade nettle | Mar 26, 2024 | Apr 5, 2021 |
| Amazon Linux Ami 2 | — | Upgrade nettle-develUpgrade nettleUpgrade nettle-debuginfo | Apr 23, 2021 | Apr 5, 2021 |
| Centos_linux | — | Upgrade gnutls-dane-debuginfoUpgrade gnutlsUpgrade gnutls-develUpgrade nettle-debuginfoUpgrade gnutls-c++Upgrade nettle-debugsourceUpgrade gnutls-c++-debuginfoUpgrade gnutls-debugsourceUpgrade gnutls-utils-debuginfoUpgrade nettleUpgrade nettle-develUpgrade gnutls-utilsUpgrade gnutls-debuginfoUpgrade gnutls-dane | Apr 9, 2021 | Apr 5, 2021 |
| Debian | — | Upgrade nettle | Jun 21, 2021 | Apr 5, 2021 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 8, 2021 |
| Gentoo Linux | — | Upgrade dev-libs/nettle. | May 28, 2021 | Apr 5, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nettleUpgrade nettle-devel | Aug 10, 2021 | Apr 5, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade nettle | Sep 29, 2021 | Apr 5, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Aug 24, 2022 |
| Oracle Solaris | — | Upgrade library/security/nettle to version 3.7.2-11.4.36.0.1.101.0 on Solaris 11.4 | Aug 27, 2021 | Apr 5, 2021 |
| Oracle_linux | — | Upgrade gnutls-develUpgrade gnutlsUpgrade nettleUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade nettle-develUpgrade gnutls-c++ | Apr 9, 2021 | Mar 16, 2021 |
| Redhat_linux | — | Upgrade nettle-debugsourceUpgrade gnutls-daneUpgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-utils-debuginfoUpgrade gnutls-debugsourceUpgrade nettle-develUpgrade nettle-debuginfoUpgrade gnutls-develUpgrade gnutls-c++-debuginfoUpgrade gnutls-dane-debuginfoUpgrade nettleUpgrade gnutls-c++Upgrade gnutls-debuginfo | Apr 9, 2021 | Apr 5, 2021 |
| Rocky_linux | — | Upgrade gnutls-c++-debuginfoUpgrade gnutls-daneUpgrade gnutls-debuginfoUpgrade nettle-debuginfoUpgrade gnutls-utils-debuginfoUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade nettleUpgrade gnutls-debugsourceUpgrade gnutls-develUpgrade nettle-debugsourceUpgrade gnutls-dane-debuginfoUpgrade nettle-devel | Mar 12, 2024 | Apr 5, 2021 |
| Suse | — | Upgrade libnettle6Upgrade libhogweed4Upgrade libhogweed2-32bitUpgrade libhogweed2Upgrade libnettle4Upgrade libnettle-devel-32bitUpgrade nettleUpgrade libhogweed6Upgrade libhogweed4-32bitUpgrade libnettle-develUpgrade libhogweed6-32bitUpgrade libnettle8-32bitUpgrade libnettle4-32bitUpgrade libnettle6-32bitUpgrade libnettle8 | Apr 29, 2021 | Apr 5, 2021 |
| Ubuntu | — | Upgrade libnettle8Upgrade libnettle7Upgrade libnettle6 | Apr 14, 2021 | Apr 5, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 5, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub