CVE-2021-3580

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-05 · updated 2026-10-14
Weakness: CWE-20

Description

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

Affected products

Debian Linux: 9.0
NetApp ONTAP Select Deploy administration utility: all versions
[UNKNOWN] nettle: before 3.7.3 — fixed in 3.7.3
Red Hat Enterprise Linux: 7.0, 8.0

How to fix

Upgrade to a fixed version: [UNKNOWN] nettle 3.7.3. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1967983
https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
https://security.gentoo.org/glsa/202401-24
https://security.netapp.com/advisory/ntap-20211104-0006/
https://bugzilla.redhat.com/show_bug.cgi?id=1967983
https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
https://security.gentoo.org/glsa/202401-24
https://security.netapp.com/advisory/ntap-20211104-0006/
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2021-3580 or the next vulnerability affects your stack