x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | debian-upgrade-nettle | Jul 30, 2024 | Feb 23, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-nettlehuawei-euleros-2_0_sp1-upgrade-nettle-devel | Nov 30, 2017 | Feb 23, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-nettleoracle-linux-upgrade-nettle-devel | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | redhat-upgrade-nettleredhat-upgrade-nettle-debuginforedhat-upgrade-nettle-devel | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | suse-upgrade-libhogweed2suse-upgrade-libhogweed2-32bitsuse-upgrade-libhogweed4suse-upgrade-libhogweed4-32bitsuse-upgrade-libnettle-develsuse-upgrade-libnettle4suse-upgrade-libnettle4-32bitsuse-upgrade-libnettle6suse-upgrade-libnettle6-32bit | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | ubuntu-upgrade-libnettle4ubuntu-upgrade-libnettle6 | Feb 15, 2016 | Feb 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub