Format: 1.8
Date: Fri, 18 Jun 2021 04:27:09 +0000
Source: nettle
Binary: libnettle6 libhogweed4 nettle-dev nettle-bin
Architecture: source
Version: 3.4.1-0ubuntu0.18.04.1~cloud0
Distribution: xenial
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Changed-By: Openstack Ubuntu Testing Bot <openstack-testing-bot@ubuntu.com>
Description:
 libhogweed4 - low level cryptographic library (public-key cryptos)
 libnettle6 - low level cryptographic library (symmetric and one-way cryptos)
 nettle-bin - low level cryptographic library (binary tools)
 nettle-dev - low level cryptographic library (development files)
Changes:
 nettle (3.4.1-0ubuntu0.18.04.1~cloud0) xenial-queens; urgency=medium
 .
   * New upstream release for the Ubuntu Cloud Archive.
 .
 nettle (3.4.1-0ubuntu0.18.04.1) bionic-security; urgency=medium
 .
   * SECURITY UPDATE: Bleichenbacher type side-channel based padding oracle
     attack in endian conversion of RSA decrypted PKCS#1 v1.5 data
     - Updated to upstream 3.4.1 tarball.
     - debian/*symbols: added new 3.4.1 symbols.
     - CVE-2018-16869
   * SECURITY UPDATE: crash in RSA decryption via manipulated ciphertext
     - debian/patches/CVE-2021-3580-1.patch: change _rsa_sec_compute_root_tr
       to take a fixed input size in rsa-decrypt-tr.c, rsa-internal.h,
       rsa-sec-decrypt.c, rsa-sign-tr.c, testsuite/rsa-encrypt-test.c.
     - debian/patches/CVE-2021-3580-2.patch: add input check to rsa_decrypt
       family of functions in rsa-decrypt-tr.c, rsa-decrypt.c,
       rsa-sec-decrypt.c, rsa.h, testsuite/rsa-encrypt-test.c.
     - CVE-2021-3580
Checksums-Sha1:
 573262ef2fd5a824689679be55e4102633723d5a 2167 nettle_3.4.1-0ubuntu0.18.04.1~cloud0.dsc
 56a81ed4a8d35489d8bddd99d5262fe3958a52b4 1947053 nettle_3.4.1.orig.tar.gz
 65f66d0571cad3165c868c51c5d93830f45dc615 27240 nettle_3.4.1-0ubuntu0.18.04.1~cloud0.debian.tar.xz
Checksums-Sha256:
 025553d4c79f7a507f2a72d191e70d6a9e100328c746423ad2dd5b84321caa65 2167 nettle_3.4.1-0ubuntu0.18.04.1~cloud0.dsc
 f941cf1535cd5d1819be5ccae5babef01f6db611f9b5a777bae9c7604b8a92ad 1947053 nettle_3.4.1.orig.tar.gz
 97f2e8dc178bcbe7af361415bccc68e09b4ffcfb073208c6e542c02f851e2b3e 27240 nettle_3.4.1-0ubuntu0.18.04.1~cloud0.debian.tar.xz
Files:
 547a6f82e6af483a17e2e2264474701d 2167 libs optional nettle_3.4.1-0ubuntu0.18.04.1~cloud0.dsc
 9bdebb0e2f638d3b9d91f7fc264b70c1 1947053 libs optional nettle_3.4.1.orig.tar.gz
 64bc6caf82beb2656d0c0944f25d7f35 27240 libs optional nettle_3.4.1-0ubuntu0.18.04.1~cloud0.debian.tar.xz
Original-Maintainer: Magnus Holmgren <holmgren@debian.org>