Skip to content
OpenAdvisories
Medium ELSA-2016-2582 4 CVEs

Moderate: nettle security and bug fix update (Oracle Linux 7)

Published Nov 9, 2016 · Updated Nov 9, 2016

Ecosystem: Oracle Linux

Summary

[2.7.1-8]
- Use a cache-silent version of mpz_powm to prevent cache-timing
attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)

[2.7.1-5]
- Fixed SHA-3 implementation to conform to final standard (#1252936)
- Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
in secp256r1 and secp384r1 calculations (#1314374)

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 nettle 0:2.7.1-8.el7
Oracle Linux · 7 nettle-devel 0:2.7.1-8.el7

Vulnerabilities 4

  • Unscored —
    CVE-2015-8803

    The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces inc…

    nettle nettle Debian Ubuntu
  • Unscored —
    CVE-2015-8804

    x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output i…

    nettle nettle Debian Ubuntu
  • Unscored —
    CVE-2015-8805

    The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces inc…

    nettle nettle Debian Ubuntu
  • Unscored —
    CVE-2016-6489

    The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side chann…

    nettle nettle Debian Ubuntu