FreshPorts - VuXML
This page displays vulnerability information about FreeBSD Ports.
The VUXML data was last processed by FreshPorts on 2023-02-06 01:31:55 UTC
List all Vulnerabilities, by package
List all Vulnerabilities, by date
These are the vulnerabilities relating to the commit you have selected:
|80f9dbd3-8eec-11eb-b9e8-3525f51429a0||nettle 3.7.2 -- fix serious ECDSA signature verify bug|
Niels MÃ¶ller reports:
I've prepared a new bug-fix release of Nettle, a low-level
cryptographics library, to fix a serious bug in the function to
verify ECDSA signatures. Implications include an assertion failure,
which could be used for denial-of-service, when verifying signatures
on the secp_224r1 and secp521_r1 curves.
Even when no assert is triggered in ecdsa_verify, ECC point
multiplication may get invalid intermediate values as input, and
produce incorrect results. [...] It appears difficult to construct
an alleged signature that makes the function misbehave in such a way
that an invalid signature is accepted as valid, but such attacks
can't be ruled out without further analysis.