Critical severity · published Jun 25, 2023
CVE-2023-36660
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption
9.8
CVSS
1%
EPSS
No
On KEV
Description
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nettle · Nettle Project
3.9 · source: NVD
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36660
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1212112
Patch
https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618f
Patch
https://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601
security.gentoo.org
https://security.gentoo.org/glsa/202401-24
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
More from Nettle
9.8
CVE-2015-8805
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST…
9.8
CVE-2015-8804
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which…
9.8
CVE-2015-8803
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST…
8.1
CVE-2021-20305
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography…
7.5
CVE-2021-3580
A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext