FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
80f9dbd3-8eec-11eb-b9e8-3525f51429a0nettle 3.7.2 -- fix serious ECDSA signature verify bug

Niels Möller reports:

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves.

Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. [...] It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis.


Discovery 2021-03-21
Entry 2021-03-27
nettle
lt 3.7.2

linux-c7-nettle
lt 3.7.2

https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html