Bug 964845 (CVE-2015-8803) - VUL-0: CVE-2015-8803: nettle: Miscomputations of elliptic curve scalar multiplications
Summary: VUL-0: CVE-2015-8803: nettle: Miscomputations of elliptic curve scalar multip...
Status: RESOLVED FIXED
Alias: CVE-2015-8803
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/161529/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-03 08:45 UTC by Sebastian Krahmer
Modified: 2019-02-03 09:52 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2016-02-03 08:45:49 UTC 
Quoting from OSS-sec:

> I discovered two carry propagation bugs

> The P-256 bug is
> in the C code and affects multiple architectures.
>
> https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003028.html
>
> secp256 calculation bug (already fixed)
>
> Sat Dec 12 21:48:58 CET 2015
>
> https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
>
> 2015-12-10

Use CVE-2015-8803.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8803
http://seclists.org/oss-sec/2016/q1/273
Comment 1 Bernhard Wiedemann 2016-02-05 14:00:09 UTC 
This is an autogenerated message for OBS integration:
This bug (964845) was mentioned in
https://build.opensuse.org/request/show/357899 Factory / libnettle
Comment 2 Tomáš Chvátal 2016-02-06 08:37:45 UTC 
Patches sent to factory/sle12 and openSUSE 13.2.
Comment 4 Bernhard Wiedemann 2016-02-06 09:00:09 UTC 
This is an autogenerated message for OBS integration:
This bug (964845) was mentioned in
https://build.opensuse.org/request/show/358011 13.2 / libnettle
Comment 5 Swamp Workflow Management 2016-02-15 17:11:37 UTC 
SUSE-SU-2016:0455-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 964845,964847,964849
CVE References: CVE-2015-8803,CVE-2015-8804,CVE-2015-8805
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libnettle-2.7.1-9.1
SUSE Linux Enterprise Software Development Kit 12 (src):    libnettle-2.7.1-9.1
SUSE Linux Enterprise Server 12-SP1 (src):    libnettle-2.7.1-9.1
SUSE Linux Enterprise Server 12 (src):    libnettle-2.7.1-9.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libnettle-2.7.1-9.1
SUSE Linux Enterprise Desktop 12 (src):    libnettle-2.7.1-9.1
Comment 6 Andreas Stieger 2016-02-16 16:38:48 UTC 
release for openSUSE
Comment 7 Swamp Workflow Management 2016-02-16 20:11:33 UTC 
openSUSE-SU-2016:0475-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 964845,964847,964849
CVE References: CVE-2015-8803,CVE-2015-8804,CVE-2015-8805
Sources used:
openSUSE Leap 42.1 (src):    libnettle-2.7.1-9.1
Comment 8 Swamp Workflow Management 2016-02-16 20:12:22 UTC 
openSUSE-SU-2016:0477-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 964845,964847,964849
CVE References: CVE-2015-8803,CVE-2015-8804,CVE-2015-8805
Sources used:
openSUSE 13.2 (src):    libnettle-2.7.1-6.5.1
Comment 9 Swamp Workflow Management 2016-02-17 00:12:09 UTC 
openSUSE-SU-2016:0486-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 964845,964847,964849
CVE References: CVE-2015-8803,CVE-2015-8804,CVE-2015-8805
Sources used:
openSUSE 13.1 (src):    libnettle-2.7.1-2.3.1
Comment 10 Swamp Workflow Management 2019-02-03 09:52:23 UTC 
This is an autogenerated message for OBS integration:
This bug (964845) was mentioned in
https://build.opensuse.org/request/show/670843 15.1 / libnettle