Detections
Analytics
NewStart CGSL MAIN 6.02 : nettle Multiple Vulnerabilities (NS-SA-2022-0091)
critical Nessus Plugin ID 167470
Synopsis
The remote NewStart CGSL host is affected by multiple vulnerabilities.Description
The remote NewStart CGSL host, running version MAIN 6.02, has nettle packages installed that are affected by multiple vulnerabilities:- A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences. (CVE-2021-20231)
- A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences. (CVE-2021-20232)
- A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service. (CVE-2021-3580)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the vulnerable CGSL nettle packages. Note that updated packages may not be available yet. Please contact ZTE for more information.See Also
http://security.gd-linux.com/notice/NS-SA-2022-0091
http://security.gd-linux.com/info/CVE-2021-20231
Plugin Details
Severity: Critical
ID: 167470
File Name: newstart_cgsl_NS-SA-2022-0091_nettle.nasl
Version: 1.3
Type: local
Published: 11/15/2022
Updated: 10/4/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-20232
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:zte:cgsl_main:nettle, p-cpe:/a:zte:cgsl_main:nettle-devel, cpe:/o:zte:cgsl_main:6
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/9/2022
Vulnerability Publication Date: 3/12/2021