The Multicluster Engine for Kubernetes 2.6.3 images include fixes for three related vulnerabilities in the nodejs/elliptic cryptographic library: CVE-2024-42459 (EDDSA signature malleability due to missing signature length check), CVE-2024-42460 (ECDSA signature malleability due to missing leading bit checks on r and s values), and CVE-2024-42461 (ECDSA malleability from allowing BER-encoded signatures). These issues could allow manipulation of cryptographic signatures, potentially undermining signature integrity. The advisory is rated as moderate severity by Red Hat Product Security. No CVSS scores are provided in the advisory. The vulnerabilities are addressed by updated container images for Multicluster Engine for Kubernetes 2.6.3.

The vulnerabilities affect the cryptographic signature verification process within the nodejs/elliptic library used by Multicluster Engine for Kubernetes. Signature malleability can undermine the integrity of cryptographic signatures, potentially allowing attackers to alter signatures without detection. This could impact the trustworthiness of signature-based authentication or authorization mechanisms within the affected component. Red Hat rates the overall security impact as moderate. There are no known exploits in the wild at this time.

Red Hat has released updated Multicluster Engine for Kubernetes 2.6.3 container images that address these vulnerabilities. Users should upgrade to the updated images as per Red Hat's installation documentation to remediate the issues. Since this is not a cloud service, remediation requires user action to deploy the updated images. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.