Input validation error in Nettle - CVE-2021-3580

Vulnerability identifier: #VU53978

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3580

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in nettle's RSA decryption functions due to insufficient validation of certain ciphertexts. A remote attacker can send specially crafted  data to the server and perform a denial of service (DoS) attack.

Nettle
Arch Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Red Hat Enterprise Linux for IBM z Systems
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
cflinuxfs3
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
Ansible Automation Platform
Security Event Manager (SEM)
IBM MQ
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack
nettle (Debian package)
nettle (Red Hat package)
gnutls (Red Hat package)
libnettle4-32bit
libnettle-devel
libnettle4-debuginfo-32bit
libnettle4-debuginfo
libnettle4
libnettle-debugsource
libhogweed2-debuginfo-32bit
libhogweed2-debuginfo
libhogweed2-32bit
libhogweed2
libnettle6 (Ubuntu package)
libhogweed4-32bit-debuginfo
libnettle6
libhogweed4-debuginfo
libnettle6-debuginfo
libhogweed4
libhogweed4-32bit
libnettle6-32bit-debuginfo
libnettle6-32bit
libnettle7 (Ubuntu package)
libnettle8 (Ubuntu package)
nettle-help
nettle-debugsource
nettle
nettle-debuginfo
nettle-devel
Red Hat OpenShift Serverless
OpenShift Virtualization
IBM Supplied MQ Advanced Queue Manager Container images
Dell EMC VxRail Appliance
SecurID Authentication Manager

Install updates from vendor's website.

Nettle - update to 3.7.3
cflinuxfs3 - update to 0.244.0
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
nettle (Debian package) - update to 3.4.1-1+deb10u1
nettle (Red Hat package) - update to 3.4.1-7.el8
gnutls (Red Hat package) - update to 3.6.16-4.el8
Red Hat OpenShift Container Platform - addressed in versions 4.11.0, 4.11.45
Security Event Manager (SEM) - update to 2021.4
IBM MQ - addressed in versions 1.3.4 EUS, 1.8.2 CD
Red Hat OpenShift Serverless - update to 1.20.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
libnettle4-32bit - update to 2.7.1-13.6.1
libnettle-devel - addressed in versions 2.7.1-13.6.1, 3.4.1-4.18.1
libnettle4-debuginfo-32bit - update to 2.7.1-13.6.1
libnettle4-debuginfo - update to 2.7.1-13.6.1
libnettle4 - update to 2.7.1-13.6.1
libnettle-debugsource - addressed in versions 2.7.1-13.6.1, 3.4.1-4.18.1
libhogweed2-debuginfo-32bit - update to 2.7.1-13.6.1
libhogweed2-debuginfo - update to 2.7.1-13.6.1
libhogweed2-32bit - update to 2.7.1-13.6.1
libhogweed2 - update to 2.7.1-13.6.1
libnettle6 (Ubuntu package) - update to 3.4.1-0ubuntu0.18.04.1
libhogweed4-32bit-debuginfo - update to 3.4.1-4.18.1
libnettle6 - update to 3.4.1-4.18.1
libhogweed4-debuginfo - update to 3.4.1-4.18.1
libnettle6-debuginfo - update to 3.4.1-4.18.1
libhogweed4 - update to 3.4.1-4.18.1
libhogweed4-32bit - update to 3.4.1-4.18.1
libnettle6-32bit-debuginfo - update to 3.4.1-4.18.1
libnettle6-32bit - update to 3.4.1-4.18.1
libnettle7 (Ubuntu package) - update to 3.5.1+really3.5.1-2ubuntu0.2
libnettle8 (Ubuntu package) - addressed in versions 3.6-2ubuntu0.2, 3.7-2.1ubuntu1.1
nettle-help - update to 3.6-3
nettle-debugsource - update to 3.6-3
nettle - update to 3.6-3
nettle-debuginfo - update to 3.6-3
nettle-devel - update to 3.6-3
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
OpenShift Virtualization - update to 4.11.0
Dell EMC VxRail Appliance - update to 7.0.203
SecurID Authentication Manager - update to 8.5 Patch 5
IBM Supplied MQ Advanced Queue Manager Container images - addressed in versions 9.2.0.5-r2-eus, 9.2.5.0-r3
Red Hat OpenStack - update to 16.2

• https://bugzilla.redhat.com/show_bug.cgi?id=1967983
• https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1e087f4799edaefe
• https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812fdb39cae4adf98c

• Arch Linux update for nettle
• Denial of service in GNU Nettle
• Multiple vulnerabilities in cflinuxfs3
• Debian update for nettle
• Red Hat Enterprise Linux 8 update for gnutls and nettle
• SUSE update for libnettle
• SUSE update for libnettle
• Ubuntu update for nettle
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift Virtualization
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• SolarWinds Security Event Manager (SEM) update for third-party components
• openEuler update for nettle
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• SecurID Authentication Manager update for third-party components
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2