This advisory addresses multiple signature malleability vulnerabilities in the nodejs/elliptic library used by Red Hat Advanced Cluster Management for Kubernetes 2.10.6. Specifically, CVE-2024-42459 involves EDDSA signature malleability caused by a missing signature length check allowing zero-valued bytes to be removed or appended. CVE-2024-42460 involves ECDSA signature malleability due to missing checks on the leading bit of signature components r and s. CVE-2024-42461 involves ECDSA malleability due to acceptance of BER-encoded signatures. These vulnerabilities could affect cryptographic signature validation integrity. The advisory provides updated container images that fix these bugs.

The vulnerabilities cause signature malleability issues in cryptographic operations within the nodejs/elliptic library, potentially undermining the integrity of signature verification processes in Red Hat Advanced Cluster Management for Kubernetes. This could affect security policies and cluster management operations relying on these signatures. The impact is rated as moderate by Red Hat Product Security. There are no known exploits in the wild at this time.

Red Hat has released updated container images for Red Hat Advanced Cluster Management for Kubernetes 2.10.6 that fix these signature malleability vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.