8.1

CVE-2021-20305: debian debian_linux

CVSS: 8.1v3.1HighModified
AliasesALPINE-CVE-2021-20305SUSE-SU-2021:1399-1SUSE-SU-2021:1412-1
Published 05-04-2021Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2021-20305 is a high (CVSS 8.1) vulnerability in debian debian_linux. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
1.74%
0%100%
Low · +0.06 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2
DLA-2760-1DSA-4933-1MGASA-2021-0300CGA-HQPF-2P85-63RGCGA-JRGV-6VMG-8276

Timeline

  1. 05-04-2021
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

1.74%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

+0.06 pp

From 1.69% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse29 products
  • libnettle&distro=HPE Helion OpenStack 8< 2.7.1-13.3.1
  • libnettle&distro=SUSE Enterprise Storage 6< 3.4.1-4.15.1
  • libnettle&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 3.4.1-4.15.1
  • libnettle&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 3.4.1-4.15.1
  • libnettle&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 3.4.1-4.15.1
Redhat15 products
  • enterprise_linuxEOL7.0 | 8.0
  • gnutls< 0:3.6.14-8.el8_3 | < 0:3.6.8-10.el8_1 | < 0:3.6.8-12.el8_2
  • gnutls-c++< 0:3.6.14-8.el8_3 | < 0:3.6.8-10.el8_1 | < 0:3.6.8-12.el8_2
  • gnutls-c++-debuginfo< 0:3.6.14-8.el8_3 | < 0:3.6.8-10.el8_1 | < 0:3.6.8-12.el8_2
  • gnutls-dane< 0:3.6.14-8.el8_3 | < 0:3.6.8-10.el8_1 | < 0:3.6.8-12.el8_2
Debian2 products
Netapp2 products
Alpine1 product
  • nettle< 3.7.2-r0
Chainguard1 product
  • nettleAll versions (No fix recorded)
Fedoraproject1 product
Nettle_project1 product
Opensuse1 product
  • libnettle&distro=openSUSE Leap 15.2< 3.4.1-lp152.4.3.1
Ubuntu1 product
  • nettleAll versions (No fix recorded) | < 3.2-1ubuntu0.16.04.2 | < 3.4-1ubuntu0.1 | < 3.5.1+really3.5.1-2ubuntu0.1
Wolfi1 product
  • nettleAll versions (No fix recorded)

11 vendors · 55 products

References

38 links
Show all 38 references