CVE-2015-8803: Critical severity nettle vulnerability
The ecc256modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8803?
CVE-2015-8803 is considered a high severity vulnerability due to the potential for improper output in cryptographic computations.
How do I fix CVE-2015-8803?
To fix CVE-2015-8803, upgrade Nettle to version 3.2 or later.
Which software versions are affected by CVE-2015-8803?
CVE-2015-8803 affects Nettle versions prior to 3.2, as well as specific versions of Ubuntu Linux and openSUSE.
What type of attack can CVE-2015-8803 facilitate?
CVE-2015-8803 can allow attackers to leverage incorrect cryptographic outputs to exploit unspecified vectors.
Is CVE-2015-8803 a local or remote vulnerability?
The nature of CVE-2015-8803 allows potential exploitation through local or remote vectors, depending on the attack scenario.