-
nettle (3.2-1ubuntu0.16.04.2) xenial-security; urgency=medium
* SECURITY UPDATE: Out of Bound memory access in signature verification
- debian/patches/CVE-2021-20305-1.patch: new functions
ecc_mod_mul_canonical and ecc_mod_sqr_canonical in
curve25519-eh-to-x.c, curve448-eh-to-x.c, ecc-eh-to-a.c,
ecc-internal.h, ecc-j-to-a.c, ecc-mod-arith.c, ecc-mul-m.c.
- debian/patches/CVE-2021-20305-2.patch: use ecc_mod_mul_canonical for
point comparison in eddsa-verify.c.
- debian/patches/CVE-2021-20305-3.patch: fix bug in ecc_ecdsa_verify in
ecc-ecdsa-verify.c, testsuite/ecdsa-sign-test.c.
- debian/patches/CVE-2021-20305-4.patch: ensure ecdsa_sign output is
canonically reduced in ecc-ecdsa-sign.c.
- debian/patches/CVE-2021-20305-6.patch: similar fix for eddsa in
eddsa-hash.c.
- debian/libhogweed4.symbols: added new symbols.
- CVE-2021-20305
-- Marc Deslauriers <email address hidden> Wed, 07 Apr 2021 10:17:48 -0400
-
nettle (3.2-1ubuntu0.16.04.1) xenial-security; urgency=medium
* SECURITY UPDATE: RSA cache timing side-channel attack
- debian/patches/CVE-2016-6489.patch: use mpz_powm_sec and check for
invalid keys in bignum.h, configure.ac, dsa-sign.c, rsa-blind.c,
rsa-sign-tr.c, rsa-sign.c, rsa.c, testsuite/rsa-test.c.
- CVE-2016-6489
-- Marc Deslauriers <email address hidden> Fri, 03 Feb 2017 08:22:52 -0500
-
nettle (3.2-1) unstable; urgency=medium
* New upstream release.
* Includes fixes for CVE-2015-8803, CVE-2015-8804, and CVE-2015-8805
(Closes: #813679).
-- Magnus Holmgren <email address hidden> Sat, 06 Feb 2016 18:59:30 +0100
-
nettle (3.1.1-4) unstable; urgency=low
* multiarch_dev.patch (new): Remove compiler version info causing
nettle-dev for different architectures to be incompatible with each
other from nettle-stdint.h (Closes: #783699).
* Rearrange debian/copyright to comply with the machine-readable format
specification.
-- Magnus Holmgren <email address hidden> Mon, 03 Aug 2015 20:02:18 +0200
