CVE-2021-3580: Input Validation

Reference Links

• https://security-tracker.debian.org/tracker/CVE-2021-3580
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3580
• https://bugzilla.redhat.com/show_bug.cgi?id=1967983
• https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1e087f4799edaefe
• https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812fdb39cae4adf98c
• https://security-tracker.debian.org/tracker/CVE-2021-20305
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989631
• https://exchange.xforce.ibmcloud.com/vulnerabilities/204056
• https://www.ibm.com/support/pages/node/6574787 (Advisory)
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
• https://security.netapp.com/advisory/ntap-20211104-0006/
• https://security.gentoo.org/glsa/202401-24
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1969396
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1969395
• https://access.redhat.com/errata/RHSA-2021:4451
• https://access.redhat.com/security/cve/cve-2021-3580

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6574787

Frequently Asked Questions

• What is the CVE ID of this vulnerability?

  The CVE ID of this vulnerability is CVE-2021-3580.

• What is the severity of CVE-2021-3580?

  The severity of CVE-2021-3580 is medium with a CVSS score of 5.9.

• How does CVE-2021-3580 affect GNU Nettle?

  CVE-2021-3580 affects GNU Nettle by causing a denial of service due to a flaw in the RSA decryption functions.

• How can an attacker exploit CVE-2021-3580?

  An attacker can exploit CVE-2021-3580 by sending specially-crafted ciphertext to the affected application.

• How can I fix CVE-2021-3580 in IBM QRadar SIEM?

  You can fix CVE-2021-3580 in IBM QRadar SIEM by applying the appropriate patch. For version 7.5.0 GA, use the patch available at: [IBM QRadar SIEM 7.5.0 GA Patch](https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=All&platform=Linux&function=fixId&fixids=7.5.0-QRADAR-QRSIEM-20220215133427&includeRequisites=1&includeSupersedes=0&downloadMethod=http&login=true) For versions 7.4.3 GA - 7.4.3 FP4, use the patch available at: [IBM QRadar SIEM 7.4.3 GA - 7.4.3 FP4 Patch](https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=All&platform=Linux&function=fixId&fixids=7.4.3-QRADAR-QRSIEM-20220307203834&includeRequisites=1&includeSupersedes=0&downloadMethod=http) For versions 7.3.3 GA - 7.3.3 FP10, use the patch available at: [IBM QRadar SIEM 7.3.3 GA - 7.3.3 FP10 Patch](https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM%20Security%20QRadar%20Vulnerability%20Manager&release=All&platform=All&function=fixId&fixids=7.3.3-QRADAR-QRSIEM-20220318161607&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=SAR)