This advisory covers security fixes in Red Hat Advanced Cluster Management for Kubernetes 2.9.5 container images that resolve four vulnerabilities related to signature malleability in the nodejs/elliptic cryptographic library. Specifically, CVE-2024-42459 addresses EDDSA signature malleability caused by missing signature length checks allowing zero-valued bytes to be removed or appended. CVE-2024-42460 and CVE-2024-42461 concern ECDSA signature malleability due to missing checks on the leading bit of signature components and acceptance of BER-encoded signatures, respectively. CVE-2024-48949 involves missing validation in EDDSA signature verification. These issues could undermine the integrity of cryptographic signatures used within the product. The advisory references updated container images that fix these bugs and recommends applying the update after ensuring all prior errata are applied.

The vulnerabilities affect cryptographic signature verification in the elliptic library used by Red Hat Advanced Cluster Management for Kubernetes. Signature malleability can allow attackers to manipulate signatures without detection, potentially impacting the integrity of security policies or cluster management operations. However, no known exploits in the wild have been reported. The impact is rated as high by Red Hat Product Security.

A fix is available in Red Hat Advanced Cluster Management for Kubernetes 2.9.5 container images that address these signature malleability vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for proper update procedures.