Threats Tagged 'cve-2024-48949'

Red Hat Advanced Cluster Management for Kubernetes 2.10.6 includes fixes for several bugs and security vulnerabilities related to signature malleability in the nodejs/elliptic library. These vulnerabilities involve missing checks in EDDSA and ECDSA signature handling that could allow manipulation of signature bytes. The update addresses these issues by correcting the signature validation logic. The advisory rates the security impact as moderate and provides updated container images to remediate the vulnerabilities.

Red Hat Advanced Cluster Management for Kubernetes 2.11.3 includes security fixes addressing multiple signature malleability vulnerabilities in the nodejs/elliptic library. These vulnerabilities involve missing checks in EDDSA and ECDSA signature verification, allowing manipulation of signature bytes. The update provides container image fixes to mitigate these issues.

A security vulnerability (CVE-2024-48949) affecting Grafana 7.3.6 in Red Hat Enterprise Linux 8.4 involves missing validation in the elliptic library's EDDSA signature verification. This flaw could impact the integrity of cryptographic signature verification. Red Hat has released an important security update for Grafana 7.3.6 to address this issue. The update is available for multiple Red Hat Enterprise Linux 8.4 variants including Extended Update Support, Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions. Users are advised to apply the update as per Red Hat's guidance to remediate the vulnerability.

Red Hat has issued a security advisory for Multicluster Engine for Kubernetes version 2.4.6 addressing multiple signature malleability vulnerabilities in the nodejs/elliptic library. These include issues with EDDSA and ECDSA signature verification due to missing checks and acceptance of BER-encoded signatures. The vulnerabilities could allow manipulation of cryptographic signatures. The update fixes these issues by providing updated container images. No known exploits are reported in the wild.

Red Hat Advanced Cluster Management for Kubernetes 2.9.5 container images address multiple signature malleability vulnerabilities in the nodejs/elliptic library. These include issues with EDDSA and ECDSA signature verification due to missing checks and acceptance of BER-encoded signatures. The update fixes these cryptographic validation bugs to improve security in cluster management operations.