This advisory for Red Hat Advanced Cluster Management for Kubernetes 2.10.6 addresses multiple signature malleability vulnerabilities in the nodejs/elliptic library. Specifically, CVE-2024-42459 involves EDDSA signature malleability due to a missing signature length check allowing zero-valued bytes to be removed or appended. CVE-2024-42460 concerns ECDSA signature malleability caused by missing checks on the leading bit of the r and s values. CVE-2024-42461 relates to ECDSA malleability due to acceptance of BER-encoded signatures. These issues could allow attackers to manipulate cryptographic signatures. The update fixes these bugs by improving signature validation. No CVSS scores are provided, but Red Hat rates the impact as moderate.

The vulnerabilities allow signature malleability in cryptographic operations using the nodejs/elliptic library, potentially undermining the integrity of signature verification processes. This could affect security policies and cluster management operations relying on these signatures. The advisory does not report known exploits in the wild. The impact is rated moderate by Red Hat Product Security.

Red Hat has released updated container images for Red Hat Advanced Cluster Management for Kubernetes version 2.10.6 that fix these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat. No additional mitigations are specified or required beyond applying the official update.