This advisory addresses four related vulnerabilities in the nodejs/elliptic cryptographic library used by Red Hat Advanced Cluster Management for Kubernetes. CVE-2024-42459 describes EDDSA signature malleability due to missing signature length checks allowing zero-valued bytes to be removed or appended. CVE-2024-42460 involves ECDSA signature malleability caused by missing checks on the leading bit of the r and s values. CVE-2024-42461 concerns ECDSA malleability due to acceptance of BER-encoded signatures. CVE-2024-48949 details missing validation in EDDSA signature verification. These vulnerabilities could undermine the integrity of signature verification processes. The issues are fixed in Red Hat Advanced Cluster Management for Kubernetes version 2.9.5.

The vulnerabilities allow signature malleability in cryptographic operations, potentially enabling attackers to alter signatures without detection. This could weaken the trustworthiness of signature verification within the affected product, possibly impacting security policies and cluster management operations that rely on these signatures. No known exploits in the wild have been reported at this time.

Red Hat has released version 2.9.5 of Advanced Cluster Management for Kubernetes which includes fixes for these vulnerabilities. Users should upgrade to version 2.9.5 or later. Prior to applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update documentation for detailed instructions. No additional mitigations are indicated by the vendor advisory.