Ubuntu
nettle package

nettle 3.4.1-0ubuntu0.18.04.1 source package in Ubuntu

Changelog

nettle (3.4.1-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Bleichenbacher type side-channel based padding oracle
    attack in endian conversion of RSA decrypted PKCS#1 v1.5 data
    - Updated to upstream 3.4.1 tarball.
    - debian/*symbols: added new 3.4.1 symbols.
    - CVE-2018-16869
  * SECURITY UPDATE: crash in RSA decryption via manipulated ciphertext
    - debian/patches/CVE-2021-3580-1.patch: change _rsa_sec_compute_root_tr
      to take a fixed input size in rsa-decrypt-tr.c, rsa-internal.h,
      rsa-sec-decrypt.c, rsa-sign-tr.c, testsuite/rsa-encrypt-test.c.
    - debian/patches/CVE-2021-3580-2.patch: add input check to rsa_decrypt
      family of functions in rsa-decrypt-tr.c, rsa-decrypt.c,
      rsa-sec-decrypt.c, rsa.h, testsuite/rsa-encrypt-test.c.
    - CVE-2021-3580

 -- Marc Deslauriers <email address hidden>  Mon, 14 Jun 2021 09:33:12 -0400

Upload details

Uploaded by:
Marc Deslauriers
Uploaded to:
Bionic
Original maintainer:
Ubuntu Developers
Architectures:
any
Section:
libs
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Bionic updates main libs
Bionic security main libs

Downloads

File Size SHA-256 Checksum
nettle_3.4.1.orig.tar.gz 1.9 MiB f941cf1535cd5d1819be5ccae5babef01f6db611f9b5a777bae9c7604b8a92ad
nettle_3.4.1-0ubuntu0.18.04.1.debian.tar.xz 26.4 KiB fd961a419b56ef7b8474a8e7fafb15339476c8463a44a823efc99c1172dc7f5c
nettle_3.4.1-0ubuntu0.18.04.1.dsc 2.1 KiB c649662645a098c81f5751a23e9ea10c22b7db0a03f4bd61a132428b02d167d9

View changes file

Binary packages built by this source

libhogweed4: low level cryptographic library (public-key cryptos)

 Nettle is a cryptographic library that is designed to fit easily in more or
 less any context: In crypto toolkits for object-oriented languages (C++,
 Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel
 space.
 .
 It tries to solve a problem of providing a common set of cryptographic
 algorithms for higher-level applications by implementing a
 context-independent set of cryptographic algorithms. In that light, Nettle
 doesn't do any memory allocation or I/O, it simply provides the
 cryptographic algorithms for the application to use in any environment and
 in any way it needs.
 .
 This package contains the asymmetric cryptographic algorithms, which,
 require the GNU multiple precision arithmetic library (libgmp) for
 their large integer computations.

libhogweed4-dbgsym: debug symbols for libhogweed4
libnettle6: low level cryptographic library (symmetric and one-way cryptos)

 Nettle is a cryptographic library that is designed to fit easily in more or
 less any context: In crypto toolkits for object-oriented languages (C++,
 Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel
 space.
 .
 It tries to solve a problem of providing a common set of cryptographic
 algorithms for higher-level applications by implementing a
 context-independent set of cryptographic algorithms. In that light, Nettle
 doesn't do any memory allocation or I/O, it simply provides the
 cryptographic algorithms for the application to use in any environment and
 in any way it needs.
 .
 This package contains the symmetric and one-way cryptographic
 algorithms. To avoid having this package depend on libgmp, the
 asymmetric cryptos reside in a separate library, libhogweed.

libnettle6-dbgsym: debug symbols for libnettle6
nettle-bin: low level cryptographic library (binary tools)

 Nettle is a cryptographic library that is designed to fit easily in more or
 less any context: In crypto toolkits for object-oriented languages (C++,
 Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel
 space.
 .
 It tries to solve a problem of providing a common set of cryptographic
 algorithms for higher-level applications by implementing a
 context-independent set of cryptographic algorithms. In that light, Nettle
 doesn't do any memory allocation or I/O, it simply provides the
 cryptographic algorithms for the application to use in any environment and
 in any way it needs.
 .
 This package contains binary utilities that accompany the library:
 .
    - nettle-lfib-stream - generates a pseudo-random stream, using the Knuth
      lfib (non-cryptographic) pseudo-random generator.
    - sexp-conv - conversion tool for handling the different flavours of sexp
      syntax.
    - pkcs1-conv - converts PKCS#1 keys to sexp format.
    - nettle-hash - command-line tool to compute message digests such as SHA-1.

nettle-bin-dbgsym: debug symbols for nettle-bin
nettle-dev: low level cryptographic library (development files)

 Nettle is a cryptographic library that is designed to fit easily in more or
 less any context: In crypto toolkits for object-oriented languages (C++,
 Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel
 space.
 .
 It tries to solve a problem of providing a common set of cryptographic
 algorithms for higher-level applications by implementing a
 context-independent set of cryptographic algorithms. In that light, Nettle
 doesn't do any memory allocation or I/O, it simply provides the
 cryptographic algorithms for the application to use in any environment and
 in any way it needs.
 .
 This package contains the development files (C headers and static libraries)