HighFix available

nettle — security advisory

Type: advisorySources: OSVAdvisory ID: DEBIAN-CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Products: nettle
Affected versions: Not specified
Fixed versions: 3.7.2-1
CVEs: CVE-2021-20305
Confirmed fixed CVEs: Not specified
Updated in this feed: 30 Oct 2026, 16:27 UTC · Revision 1

Source evidence

DEBIAN-CVE-2021-20305

core-osv · Original source

Published 5 Apr 2021, 22:15 UTC

osv:DEBIAN-CVE-2021-20305

nettle

Fixed versions: 3.7.2-1

nettle

Fixed versions: 3.7.2-1

nettle

Fixed versions: 3.7.2-1

Complete source record

{
  "id": "359b00c34d4ba3b98f6d3622e2d9c23db2609429e43845ed7e1e8c1345dee01d",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2021-20305",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2021-20305",
    "summary": "A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.",
    "evidence": "osv:DEBIAN-CVE-2021-20305",
    "products": [
      {
        "name": {
          "value": "nettle",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.7.2-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "nettle",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.7.2-1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "nettle",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.7.2-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "DEBIAN-CVE-2021-20305",
      "aliases": [
        "DEBIAN-CVE-2021-20305"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.7.2-1"
                }
              ]
            }
          ],
          "package": {
            "name": "nettle",
            "purl": "pkg:deb/debian/nettle?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-20305.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.7.2-1"
                }
              ]
            }
          ],
          "package": {
            "name": "nettle",
            "purl": "pkg:deb/debian/nettle?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-20305.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.7.2-1"
                }
              ]
            }
          ],
          "package": {
            "name": "nettle",
            "purl": "pkg:deb/debian/nettle?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-20305.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-15T09:47:32.786073102Z",
      "provider": "osv",
      "upstream": [
        "CVE-2021-20305"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2021-20305"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2021-20305",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 327665,
  "published_at": "2021-04-05T22:15:12.727+00:00"
}