Threats Tagged 'cve-2024-42460'

Red Hat Advanced Cluster Management for Kubernetes 2.10.6 includes fixes for several bugs and security vulnerabilities related to signature malleability in the nodejs/elliptic library. These vulnerabilities involve missing checks in EDDSA and ECDSA signature handling that could allow manipulation of signature bytes. The update addresses these issues by correcting the signature validation logic. The advisory rates the security impact as moderate and provides updated container images to remediate the vulnerabilities.

Red Hat has issued a security advisory for Multicluster Engine for Kubernetes version 2.6.3 addressing three signature malleability vulnerabilities in the nodejs/elliptic library. These vulnerabilities involve missing checks in EDDSA and ECDSA signature handling, allowing signature malleability through manipulation of signature length, leading bits, or BER-encoded signatures. The advisory rates the impact as moderate and provides updated container images to remediate the issues.

Red Hat Advanced Cluster Management for Kubernetes 2.11.3 includes security fixes addressing multiple signature malleability vulnerabilities in the nodejs/elliptic library. These vulnerabilities involve missing checks in EDDSA and ECDSA signature verification, allowing manipulation of signature bytes. The update provides container image fixes to mitigate these issues.

Red Hat has issued a security advisory for Multicluster Engine for Kubernetes version 2.4.6 addressing multiple signature malleability vulnerabilities in the nodejs/elliptic library. These include issues with EDDSA and ECDSA signature verification due to missing checks and acceptance of BER-encoded signatures. The vulnerabilities could allow manipulation of cryptographic signatures. The update fixes these issues by providing updated container images. No known exploits are reported in the wild.

Red Hat Advanced Cluster Management for Kubernetes 2.9.5 container images address multiple signature malleability vulnerabilities in the nodejs/elliptic library. These include issues with EDDSA and ECDSA signature verification due to missing checks and acceptance of BER-encoded signatures. The update fixes these cryptographic validation bugs to improve security in cluster management operations.