CVE-2016-6489 Information disclosure in n/a
Attackers can discover private keys via cache side-channel attacks in Nettle's RSA and DSA decryption code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6489?
CVE-2016-6489 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 14 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
Weakness: CWE-203
Which versions are affected by CVE-2016-6489?
It affects 6 products.
Linux distribution packages (5)
libnettle SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 2.7.1-12.1 |
libnettle SUSE:Linux Enterprise Server 12 SP2 | All versions | 2.7.1-12.1 |
libnettle SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 2.7.1-12.1 |
libnettle SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 2.7.1-12.1 |
libnettle SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 2.7.1-12.1 |
Products include Canonical Ubuntu Linux, Nettle Project Nettle, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2016-6489?
Apply the vendor's patch.
Is CVE-2016-6489 being exploited?
There is no known exploitation of CVE-2016-6489 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2016-6489, DLA-593-1, GHSA-m9gx-jgm7-m42g, MGASA-2016-0290, SUSE-SU-2017:1481-1, UBUNTU-CVE-2016-6489 and 1 more.