Vulnerability · Published Aug 5, 2021 · Assigned by redhat
CVE-2021-3580
High 7.5
In plain English
A high-severity improper input validation in nettle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.7%top 14.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | gnutls | 3.6.16-4.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | gnutls-c++ | 3.6.16-4.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | gnutls-dane | 3.6.16-4.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | gnutls-devel | 3.6.16-4.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | gnutls-utils | 3.6.16-4.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | nettle | 3.4.1-7.el8 | ALSA-2021:4451 |
| AlmaLinux:8 | nettle-devel | 3.4.1-7.el8 | ALSA-2021:4451 |
| Alpine:v3.20 | nettle | 3.7.3-r0 | ALPINE-CVE-2021-3580 |
| Alpine:v3.21 | nettle | 3.7.3-r0 | ALPINE-CVE-2021-3580 |
| Alpine:v3.22 | nettle | 3.7.3-r0 | ALPINE-CVE-2021-3580 |
| Alpine:v3.23 | nettle | 3.7.3-r0 | ALPINE-CVE-2021-3580 |
| Alpine:v3.24 | nettle | 3.7.3-r0 | ALPINE-CVE-2021-3580 |
| Debian:12 | nettle | 3.7.3-1 | DEBIAN-CVE-2021-3580 |
| Debian:13 | nettle | 3.7.3-1 | DEBIAN-CVE-2021-3580 |
| Debian:14 | nettle | 3.7.3-1 | DEBIAN-CVE-2021-3580 |
| Rocky Linux:8 | gnutls | 0:3.6.16-4.el8 | RLSA-2021:4451 |
| Rocky Linux:8 | nettle | 0:3.4.1-7.el8 | RLSA-2021:4451 |
Affected products (as reported)
Weakness: CWE-20