PT-2021-5781 · Nettle+9 · Nettle+9

Huzaifa S. Sidhpurwala · Published 2021-05-17 · Updated 2024-01-16 · CVE-2021-3580

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nettle (affected versions not specified)

Description A flaw was found in the way Nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service. The vulnerability is related to insufficient input validation in the RSA decryption functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:4451

ALT-PU-2021-2125

AZL-6741

BDU:2022-00233

CESA-2021_4451

CVE-2021-3580

DLA-2760-1

DSA-4933-1

MGASA-2021-0300

OESA-2021-1320

OPENSUSE-SU-2021:0906-1

OPENSUSE-SU-2021:2143-1

OPENSUSE-SU-2021_0906-1

OPENSUSE-SU-2021_2143-1

OPENSUSE-SU-2024:10962-1

RHSA-2021:4451

RHSA-2021_4451

RLSA-2021:4451

SUSE-SU-2021:2135-1

SUSE-SU-2021:2143-1

SUSE-SU-2021_2135-1

SUSE-SU-2021_2143-1

USN-4990-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Nettle

Red Hat

Rocky Linux

Suse

Ubuntu

References · 63

• https://nvd.nist.gov/vuln/detail/CVE-2021-3580 · Security Note
• https://osv.dev/vulnerability/AZL-6741 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2760-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0300 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4451 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2143-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2135-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3580 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1967983 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-3580 · Vendor Advisory
• https://security.gentoo.org/glsa/202401-24 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4451 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1320 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-4451.html · Vendor Advisory