CVE-2021-3580

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

Nettle is a cryptographic library designed to fit any context in crypto toolkits for object-oriented languages, in applications like LSH or GnuPG, or even in kernel space.

Security Fix(es):

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.(CVE-2021-3580)

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space.

The following packages have been upgraded to a later upstream version: gnutls (3.6.16). (BZ#1956783)

Security Fix(es):

• nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

• gnutls: Use after free in client key_share extension (CVE-2021-20231)

• gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space.

The following packages have been upgraded to a later upstream version: gnutls (3.6.16). (BZ#1956783)

Security Fix(es):

• nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

• gnutls: Use after free in client key_share extension (CVE-2021-20231)

• gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-3580: add input validation to RSA decrypt family and length check to _pkcs1_sec_decrypt

• CVE-2021-3580: add input validation to RSA decrypt family and length check to _pkcs1_sec_decrypt

• CVE-2021-3580: add input validation to RSA decrypt family and length check to _pkcs1_sec_decrypt

• SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption
  • debian/patches/CVE-2018-16869-1.patch: add side-channel silent memeql_sec and cnd_memcpy in memeql-sec.c, cnd-memcpy.c, memops.h, ccm.c, examples/rsa-decrypt.c, Makefile.in, testsuite.
  • debian/patches/CVE-2018-16869-2.patch: add side-channel silent RSA root function _rsa_sec_compute_root and mpn_get_base256 in rsa-sec-compute-root.c, rsa-internal.h, gmp-glue.c, gmp-glue.h, Makefile.in.
  • debian/patches/CVE-2018-16869-3.patch: add side-channel silent PKCS#1 decoding _pkcs1_sec_decrypt in pkcs1-sec-decrypt.c, rsa-internal.h, Makefile.in, testsuite.
  • debian/patches/CVE-2018-16869-4.patch: add rsa_sec_decrypt and use the side-channel silent root in rsa_compute_root_tr and rsa_compute_root, and reject bad private keys early, in rsa-sec-decrypt.c, rsa-sign-tr.c, rsa-sign.c, rsa-sec-compute-root.c, rsa.h, Makefile.in, testsuite.
  • debian/patches/CVE-2018-16869-5.patch: require input in range and of fixed size in rsa_sec_decrypt, rsa_decrypt_tr, rsa_decrypt and rsa_sec_compute_root_tr, and check the message length in _pkcs1_sec_decrypt, in pkcs1-sec-decrypt.c, rsa-decrypt-tr.c, rsa-decrypt.c, rsa-sec-decrypt.c, rsa-sign-tr.c, rsa.h, testsuite.
  • debian/patches/CVE-2018-16869-6.patch: strip the PKCS#1 padding in rsa_decrypt and rsa_decrypt_tr with the side-channel silent _pkcs1_sec_decrypt_variable, in pkcs1-sec-decrypt.c, pkcs1-decrypt.c, rsa-decrypt-tr.c, rsa-internal.h, testsuite.
  • debian/libhogweed4.symbols, debian/libnettle6.symbols: added new symbols.
  • CVE-2018-16869
  • CVE-2021-3580 (the input range checks in CVE-2018-16869-5.patch)

Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580).

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation (CVE-2021-20305).

The Mageia 8 nettle package has been updated to version 3.7.3 and the Mageia 7 nettle package has been patched to fix these issues.

This update for libnettle fixes the following issues:

• CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libnettle fixes the following issues:

• CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060).

These are all security issues fixed in the libhogweed6-3.7.3-1.2 package on the GA media of openSUSE Tumbleweed.

This update for libnettle fixes the following issues:

• CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060).

This update for libnettle fixes the following issues:

• CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060).

It was discovered that Nettle incorrectly handled RSA decryption. A remote attacker could possibly use this issue to cause Nettle to crash, resulting in a denial of service. (CVE-2021-3580)

It was discovered that Nettle incorrectly handled certain padding oracles. A remote attacker could possibly use this issue to perform a variant of the Bleichenbacher attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16869)