CVE-2023-36660
published 2023-06-25CVE-2023-36660: The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.02%
59.6th percentile
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nettle | — | — |
| nettle_project | nettle | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-whjr-4v2f-wjp4: The OCB feature in libnettle in Nettle 3
ghsa_unreviewed·2023-06-26
CVE-2023-36660 [CRITICAL] CWE-787 GHSA-whjr-4v2f-wjp4: The OCB feature in libnettle in Nettle 3
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
Red Hat
nettle: Memory corruption in OCB handling
vendor_redhat·2023-06-26·CVSS 9.8
CVE-2023-36660 [CRITICAL] CWE-119 nettle: Memory corruption in OCB handling
nettle: Memory corruption in OCB handling
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
A vulnerability was found in Nettle. The issue occurs in the new Offset Code Book (OCB) code and may cause a denial of service or other problems, leading to memory corruption.
Package: nettle (Red Hat Enterprise Linux 7) - Not affected
Package: nettle (Red Hat Enterprise Linux 8) - Not affected
Package: nettle (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2023-36660: nettle - The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption...
vendor_debian·2023·CVSS 9.8
CVE-2023-36660 [CRITICAL] CVE-2023-36660: nettle - The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption...
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.suse.com/show_bug.cgi?id=1212112https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618fhttps://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601https://security.gentoo.org/glsa/202401-24https://bugzilla.suse.com/show_bug.cgi?id=1212112https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618fhttps://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601https://security.gentoo.org/glsa/202401-24
2023-06-25
Published