The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2280 advisory.

    Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits     for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in     kernel space.

    Security Fix(es):

    * nettle: Out of bounds memory access in signature verification (CVE-2021-20305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2760 advisory.

    Multiple vulnerabilities were discovered in nettle, a low level cryptographic library, which could result     in denial of service (remote crash in RSA decryption via specially crafted ciphertext, crash on ECDSA     signature verification) or incorrect verification of ECDSA signatures. For Debian 9 stretch, these     problems have been fixed in version 3.3-1+deb9u1. We recommend that you upgrade your nettle packages. For     the detailed security status of nettle please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/nettle Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1145 advisory.

    Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits     for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in     kernel space.

    Security Fix(es):

    * nettle: Out of bounds memory access in signature verification (CVE-2021-20305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1206 advisory.

  - nettle: Out of bounds memory access in signature verification (CVE-2021-20305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1145 advisory.

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.20. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nettle package has been released.

According to the version of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in Nettle in versions before 3.7.2,     where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve     Cryptography point (ECC) multiply function being called     with out-of-range scalers, possibly resulting in     incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion     failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as     well as system availability.(CVE-2021-20305)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AHV installed on the remote host is prior to 20201105.2030. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.2030 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5.5 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4906-1 advisory.

    It was discovered that Nettle incorrectly handled signature verification. A remote attacker could use this     issue to cause Nettle to crash, resulting in a denial of service, or possibly force invalid signatures.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
150326	RHEL 7 : nettle (RHSA-2021:2280)	Nessus	Red Hat Local Security Checks	6/8/2021	11/7/2024	high
153482	Debian DLA-2760-1 : nettle - LTS security update	Nessus	Debian Local Security Checks	9/19/2021	1/24/2025	high
148397	RHEL 7 : nettle (RHSA-2021:1145)	Nessus	Red Hat Local Security Checks	4/9/2021	11/7/2024	high
148688	CentOS 8 : gnutls and nettle (CESA-2021:1206)	Nessus	CentOS Local Security Checks	4/15/2021	4/15/2021	high
148745	CentOS 7 : nettle (RHSA-2021:1145)	Nessus	CentOS Local Security Checks	4/17/2021	10/9/2024	high
164557	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20)	Nessus	Misc.	9/1/2022	1/12/2026	critical
148904	Photon OS 1.0: Nettle PHSA-2021-1.0-0383	Nessus	PhotonOS Local Security Checks	4/21/2021	7/22/2024	high
148907	Photon OS 3.0: Nettle PHSA-2021-3.0-0223	Nessus	PhotonOS Local Security Checks	4/21/2021	8/22/2025	high
152400	EulerOS 2.0 SP8 : nettle (EulerOS-SA-2021-2307)	Nessus	Huawei Local Security Checks	8/10/2021	12/4/2023	high
164554	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.2030)	Nessus	Misc.	9/1/2022	2/17/2025	critical
164590	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5.5)	Nessus	Misc.	9/1/2022	7/22/2025	critical
148491	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Nettle vulnerability (USN-4906-1)	Nessus	Ubuntu Local Security Checks	4/14/2021	8/27/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

high

high

critical

critical

high