RHSA-2021:4451MediumCVSS 7.5

Red Hat Security Advisory: gnutls and nettle security, bug fix, and enhancement update

Published
November 9, 2021
Last Modified
October 14, 2026

🔗 CVE IDs covered (3)

CVE-2021-3580 →CVE-2021-20231 →CVE-2021-20232 →

📋 Description

CVE-2021-3580 — nettle: Remote crash in RSA decryption via manipulated ciphertext CVE-2021-20231 — gnutls: Use after free in client key_share extension CVE-2021-20232 — gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c

🎯 Affected products108

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-0:3.6.16-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-c++-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-0:3.6.16-4.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-0:3.6.16-4.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-0:3.6.16-4.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-0:3.6.16-4.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-c++-debuginfo-0:3.6.16-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • gnutls-dane-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-0:3.6.16-4.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-0:3.6.16-4.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-0:3.6.16-4.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-0:3.6.16-4.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-debuginfo-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • gnutls-dane-debuginfo-0:3.6.16-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +78 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: As per upstream: For applications that want to support older versions of nettle, the bug can be worked around by adding a check that the RSA ciphertext is in the range 0 < ciphertext < n, before attempting to decrypt it.

🔗 References (11)