CVE-2015-8805
Fixed in a distro release EPSS 3%
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
Products: nettle_project nettle, canonical ubuntu_linux, opensuse leap, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nettle | 3.2-1 |
| Debian 13 | nettle | 3.2-1 |
| Debian 14 | nettle | 3.2-1 |
| Red Hat Enterprise Linux 7 | nettle | 0:2.7.1-8.el7 |
| Red Hat Enterprise Linux 7 | nettle-debuginfo | 0:2.7.1-8.el7 |
| Red Hat Enterprise Linux 7 | nettle-devel | 0:2.7.1-8.el7 |
| SUSE Linux Enterprise Desktop 12 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Server 12 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Server 12 SP1 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libnettle | 2.7.1-9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libnettle | 2.7.1-9.1 |
| Ubuntu 14.04 LTS | nettle | 2.7.1-1ubuntu0.1 |