CVE-2021-20305

HIGH

Nettle < 3.7.2 - Incorrect Signature Verification via Out-of-Range ECC Scalar

Title source: llm
STIX 2.1

Description

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

References (6)

Core 6
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1942533
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202105-31
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4933
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211022-0002/

Scores

CVSS v3 8.1
EPSS 0.0018
EPSS Percentile 38.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-327 CWE-787
Status published
Products (8)
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 33
netapp/active_iq_unified_manager
netapp/ontap_select_deploy_administration_utility
nettle_project/nettle < 3.7.2
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
Published Apr 05, 2021
Tracked Since Feb 18, 2026