CVE-2021-20305 is a critical vulnerability in Nettle versions prior to 3.7.2, impacting signature verification functions like GOST DSA, EDDSA, and ECDSA across products from Debian, Fedora, NetApp, and Red Hat. This flaw allows an attacker to manipulate Elliptic Curve Cryptography point multiplication with out-of-range scalers, potentially leading to incorrect results, assertion failures, or invalid signature validation. With a CVSS score of 8.1 (High), the vulnerability poses significant threats to confidentiality, integrity, and availability due to its network-based attack vector and high impact, despite high attack complexity. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.7.2CPE matchmatch criteria | cpe:2.3:a:nettle_project:nettle:*:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-20305
Mar 14, 2023A flaw was found in Nettle in versions before 3.7.2 where several Nettle signature verification functions (GOST DSA EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality integrity as well as system availability.
Apr 13, 2021nettle: Out of bounds memory access in signature verification
Mar 16, 2021