Vulnerability CVE-2021-3580

Vulnerability Name:

CVE-2021-3580 (CCN-204056)

Assigned:

2021-06-04

Published:

2021-06-04

Updated:

2021-11-26

Summary:

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2021-3580

Source: CCN
Type: Red Hat Bugzilla - Bug 1967983
CVE-2021-3580 nettle: Remote crash in RSA decryption via manipulated ciphertext

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1967983

Source: XF
Type: UNKNOWN
gnunettle-cve20213580-dos(204056)

Source: CCN
Type: Nettle GIT Repository
Add input check to rsa_decrypt family of functions.

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210918 [SECURITY] [DLA 2760-1] nettle security update

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0006/

Source: CCN
Type: USN-4990-1
Nettle vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6560126 (Sterling Connect:Direct for UNIX Certified Container)
IBM Sterling Connect:Direct for UNIX Certified Container is affected by multiple vulnerabilities in Red Hat Universal Base Image version 8.4-206.1626828523 and Binutils version 2.30-93

Source: CCN
Type: IBM Security Bulletin 6574787 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to using components with Known Vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6589939 (MQ Operator)
IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from gzip, jackson-databind, libssh, gnutls, nettle and zlib

Source: CCN
Type: IBM Security Bulletin 6605839 (Security Verify Governance)
Multiple security vulnerabilities found in open source code that is shipped with IBM Security Verify Governance, Identity Manager virtual appliance component

Source: CCN
Type: IBM Security Bulletin 6854981 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Vulnerable Configuration:

Configuration 1:

cpe:/a:nettle_project:nettle:*:*:*:*:*:*:*:* (Version < 3.7.3)

Configuration 2:

cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.3:-:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.3:-:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.6.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7595	P	libhogweed6-3.8.1-150500.2.25 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:732	P	Security update for libostree (Important)	2022-09-06
oval:org.opensuse.security:def:3633	P	Security update for cifs-utils (Important)	2022-07-13
oval:org.opensuse.security:def:3448	P	busybox-1.21.1-3.3 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3010	P	apache2-2.4.23-29.43.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94560	P	ghostscript-9.52-161.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94640	P	libhogweed6-3.7.3-150400.2.21 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:6070	P	Security update for the Linux Kernel (Important)	2022-06-14
oval:org.opensuse.security:def:95299	P	Security update for helm-mirror (Moderate)	2022-05-31
oval:org.opensuse.security:def:99490	P	(Moderate)	2022-03-04
oval:org.opensuse.security:def:102012	P	Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP3) (Important)	2022-03-01
oval:org.opensuse.security:def:112646	P	libhogweed6-3.7.3-1.2 on GA media (Moderate)	2022-01-17
oval:com.redhat.rhsa:def:20214451	P	RHSA-2021:4451: gnutls and nettle security, bug fix, and enhancement update (Moderate)	2021-11-09
oval:org.opensuse.security:def:99689	P	(Important)	2021-10-26
oval:org.opensuse.security:def:99997	P	(Moderate)	2021-10-06
oval:org.opensuse.security:def:106127	P	libhogweed6-3.7.3-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:101273	P	jackson-databind-2.10.5.1-3.3.2 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:111600	P	Security update for libnettle (Important)	2021-07-11
oval:org.opensuse.security:def:111451	P	Security update for libnettle (Important)	2021-06-24
oval:org.opensuse.security:def:69495	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:31213	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:59500	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:88461	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:108678	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:55212	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:84169	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:127128	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:97133	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:10291	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:93091	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:8611	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:70431	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:99390	P	(Important)	2021-06-23
oval:org.opensuse.security:def:33677	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:64722	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:99099	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:29389	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:57469	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:86596	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:76227	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:82596	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:117454	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:9541	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:92540	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:100631	P	(Important)	2021-06-23
oval:org.opensuse.security:def:69681	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:31646	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:59758	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:89155	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:23612	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:55920	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:84628	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:73659	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:93244	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:42093	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:8793	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:91954	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:99653	P	(Important)	2021-06-23
oval:org.opensuse.security:def:33935	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:66840	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:99291	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:30097	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:57955	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:87418	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:51600	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:83304	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:125561	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:9740	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:92739	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:101463	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:5751	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:69880	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:32132	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:60295	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:89413	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:23928	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:56040	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:85677	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:73844	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:8988	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:92149	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:99967	P	(Important)	2021-06-23
oval:org.opensuse.security:def:34472	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:67159	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:30217	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:58777	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:88147	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:107939	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:51916	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:83424	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:126731	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:10109	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:92938	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:70249	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:32954	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:64537	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:98904	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:26080	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:57036	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:86110	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:75908	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:5067	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:9355	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:92341	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:100303	P	(Important)	2021-06-23

BACK