CVE-2015-8805 describes a critical vulnerability in the Nettle cryptographic library, specifically affecting its P-256 NIST elliptic curve implementation in versions prior to 3.2. The flaw, located in the ecc_256_modq function, involves improper carry propagation leading to incorrect output. This vulnerability carries a CVSS v3.0 score of 9.8 (Critical), indicating it is network-exploitable with low attack complexity, requiring no user interaction, and potentially leading to complete compromise of confidentiality, integrity, and availability. While no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available, the CVE has garnered significant community discussion, suggesting awareness among security researchers. It is not listed on the CISA KEV catalog, and media coverage is absent.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.1.1CPE matchmatch criteria | cpe:2.3:a:nettle_project:nettle:*:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
15.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* | ||
42.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* | ||
13.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.