Detections
Analytics
Alpine: multiple nettle packages: security update to 3.1.1-r1 (deprecated)
critical Tenable Cloud Security Plugin ID 400992
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and
produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers
to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
(CVE-2015-8803)
- x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces
incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have
unspecified impact via unknown vectors. (CVE-2015-8804)
- The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and
produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers
to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
(CVE-2015-8805)
See Also
https://git.alpinelinux.org/aports/commit/?id=3a2031b005debb4b0e0c83896d3719b53b2ed0b8
https://git.alpinelinux.org/aports/commit/?id=bcfec63cd2ab48fdf4bbb07ebb965ce868ab65ff
Plugin Details
Severity: Critical
ID: 400992
Version: Revision 1.25
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2015-8805
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/24/2016
Vulnerability Publication Date: 2/3/2016