This advisory addresses four related vulnerabilities in the nodejs/elliptic cryptographic library used within Red Hat Advanced Cluster Management for Kubernetes 2.11.3. The issues include EDDSA signature malleability due to missing signature length checks (CVE-2024-42459), ECDSA signature malleability from missing checks on the leading bit of signature components r and s (CVE-2024-42460), ECDSA malleability caused by acceptance of BER-encoded signatures (CVE-2024-42461), and missing validation in EDDSA signature verification (CVE-2024-48949). These flaws could allow signature manipulation, potentially undermining cryptographic assurances. The advisory provides updated container images with fixes for these vulnerabilities.

The vulnerabilities allow malleability in cryptographic signatures, which can undermine the integrity guarantees of digital signatures used in the product. This could affect security mechanisms relying on elliptic curve signatures, potentially enabling attackers to manipulate or forge signatures under certain conditions. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated container images for Advanced Cluster Management for Kubernetes 2.11.3 that address these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata are applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the provided fixes.