Nettle ecc_256_modq Function Security Vulnerability (CVE-2015-8805)
Nettle ecc_256_modq Function Security Vulnerability (CVE-2015-8805)
Release date:
Updated on:
Affected Systems:
Nettle nettle> 3.2
Description:
CVE (CAN) ID: CVE-2015-8805
Nettle is a low-level encryption library.
In versions earlier than Nettle 3.2, the ecc_256_modq function in the ecc-256.c does not properly handle carry forward, and an incorrect output occurs in the implementation of the NIST elliptic curve in the P-256, which allows attackers to exploit this vulnerability to perform security attacks.
<* Source: Niels Moeller
*>
Suggestion:
Vendor patch:
Nettle
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
Https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
This article permanently updates the link address: