UbuntuUpdates.org

Package "nettle-dev"

Name: nettle-dev

Description:

low level cryptographic library (development files)
Latest version: 3.2-1ubuntu0.16.04.2
Release: xenial (16.04)
Level: security
Repository: main
Head package: nettle
Homepage: http://www.lysator.liu.se/~nisse/nettle/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nettle-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "nettle-dev" in Xenial

Repository Area Version
base main 3.2-1
updates main 3.2-1ubuntu0.16.04.2

Changelog

Version: 3.2-1ubuntu0.16.04.2 2021-04-13 17:06:38 UTC

  nettle (3.2-1ubuntu0.16.04.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Out of Bound memory access in signature verification
    - debian/patches/CVE-2021-20305-1.patch: new functions
      ecc_mod_mul_canonical and ecc_mod_sqr_canonical in
      curve25519-eh-to-x.c, curve448-eh-to-x.c, ecc-eh-to-a.c,
      ecc-internal.h, ecc-j-to-a.c, ecc-mod-arith.c, ecc-mul-m.c.
    - debian/patches/CVE-2021-20305-2.patch: use ecc_mod_mul_canonical for
      point comparison in eddsa-verify.c.
    - debian/patches/CVE-2021-20305-3.patch: fix bug in ecc_ecdsa_verify in
      ecc-ecdsa-verify.c, testsuite/ecdsa-sign-test.c.
    - debian/patches/CVE-2021-20305-4.patch: ensure ecdsa_sign output is
      canonically reduced in ecc-ecdsa-sign.c.
    - debian/patches/CVE-2021-20305-6.patch: similar fix for eddsa in
      eddsa-hash.c.
    - debian/libhogweed4.symbols: added new symbols.
    - CVE-2021-20305

 -- Marc Deslauriers <email address hidden> Wed, 07 Apr 2021 10:17:48 -0400
Source diff to previous version
CVE-2021-20305 A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the El

Version: 3.2-1ubuntu0.16.04.1 2017-02-06 20:06:51 UTC

  nettle (3.2-1ubuntu0.16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: RSA cache timing side-channel attack
    - debian/patches/CVE-2016-6489.patch: use mpz_powm_sec and check for
      invalid keys in bignum.h, configure.ac, dsa-sign.c, rsa-blind.c,
      rsa-sign-tr.c, rsa-sign.c, rsa.c, testsuite/rsa-test.c.
    - CVE-2016-6489

 -- Marc Deslauriers <email address hidden> Fri, 03 Feb 2017 08:22:52 -0500
CVE-2016-6489 RSA code is vulnerable to cache sharing related attacks


About   -   Send Feedback to @ubuntu_updates