CVE-2015-8804

EPSS 11.88%
Published 23.02.2016 19:59:02
Last modified 12.04.2025 10:46:40
Source cve@mitre.org
Teams watchlist Login
Open Login

x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.

Affected products Warnungen 0 Metrics 3 CWE 0 References 14

Data is provided by the National Vulnerability Database (NVD)

Nettle Project ≫ Nettle Version <= 3.1.1

Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version15.10

Opensuse ≫ Leap Version42.1

Opensuse ≫ Opensuse Version13.1

Opensuse ≫ Opensuse Version13.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	11.88%	0.934

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html

http://rhn.redhat.com/errata/RHSA-2016-2582.html

http://www.openwall.com/lists/oss-security/2016/02/02/2

http://www.openwall.com/lists/oss-security/2016/02/03/1

http://www.ubuntu.com/usn/USN-2897-1

https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html

https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html

https://git.lysator.liu.se/nettle/nettle/commit/fa269b6ad06dd13c901dbd84a12e52b918a09cd7

Patch

https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003024.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2015-8804

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-8804

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-8804

EUVD