CVE-2021-3580: A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext

Description

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.7% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NE

nettle ·

nettle 3.7.3 · source: vendor, NVD

DL

Debian Linux · Debian

9.0 · source: NVD

EL

Enterprise Linux · Redhat

7.0; 8.0 · source: NVD

OS

Ontap Select Deploy Administration Utility · Netapp

All versions, or not specified · source: NVD

SS

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SS

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SS

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5 · source: CISA