The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4990-1 advisory.

  - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian     conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same     physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any     TLS connections to a vulnerable server. (CVE-2018-16869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2143-1 advisory.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the nettle package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4451 advisory.

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the nettle package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory.

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nettle package has been released.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the nettle packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2135-1 advisory.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
150857	Ubuntu 18.04 LTS / 20.04 LTS : Nettle vulnerabilities (USN-4990-1)	Nessus	Ubuntu Local Security Checks	2021/6/17	2023/10/21	medium
151103	SUSE SLED15 / SLES15 Security Update : libnettle (SUSE-SU-2021:2143-1)	Nessus	SuSE Local Security Checks	2021/6/28	2023/7/13	high
153676	EulerOS 2.0 SP9 : nettle (EulerOS-SA-2021-2560)	Nessus	Huawei Local Security Checks	2021/9/27	2021/9/27	high
155423	Oracle Linux 8 : gnutls / and / nettle (ELSA-2021-4451)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2023/11/23	critical
155488	EulerOS Virtualization 2.9.1 : nettle (EulerOS-SA-2021-2734)	Nessus	Huawei Local Security Checks	2021/11/17	2022/4/18	high
155528	EulerOS Virtualization 2.9.0 : nettle (EulerOS-SA-2021-2786)	Nessus	Huawei Local Security Checks	2021/11/17	2022/4/18	high
159015	Oracle Linux 8 : gnutls (ELSA-2022-9221)	Nessus	Oracle Linux Local Security Checks	2022/3/17	2023/11/6	critical
152785	Photon OS 1.0: Nettle PHSA-2021-1.0-0426	Nessus	PhotonOS Local Security Checks	2021/8/24	2021/9/20	high
152791	Photon OS 4.0: Nettle PHSA-2021-4.0-0083	Nessus	PhotonOS Local Security Checks	2021/8/24	2021/9/20	high
158002	EulerOS Virtualization 3.0.6.0 : nettle (EulerOS-SA-2022-1084)	Nessus	Huawei Local Security Checks	2022/2/13	2022/2/13	high
151104	SUSE SLED12 / SLES12 Security Update : libnettle (SUSE-SU-2021:2135-1)	Nessus	SuSE Local Security Checks	2021/6/28	2023/7/13	high

偵測

搜尋 Plugin

medium

high

high

critical

high

high

critical

high

high

high

high