CVE-2021-20305

Name of the Vulnerable Software and Affected Versions Nettle versions prior to 3.7.2

Description A flaw was found in the Nettle signature verification functions, including GOST DSA, EDDSA, and ECDSA, where the Elliptic Curve Cryptography point multiply function is called with out-of-range scalers, possibly resulting in incorrect results. This allows an attacker to force an invalid signature, causing an assertion failure or possible validation issues. The highest threat to this vulnerability is to confidentiality, integrity, and system availability. An attacker may exploit this vulnerability by inputting an invalid signature, potentially allowing them to execute arbitrary code.

Recommendations For versions prior to 3.7.2, update to version 3.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable signature verification functions until a patch is available. Avoid using the GOST DSA, EDDSA, and ECDSA functions in sensitive operations until the issue is resolved.