Red Hat Security AdvisoryRHSA-2024:6738
Multicluster Engine for Kubernetes 2.5.7 security updates and bug fixes
Released 2024-09-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/hive-rhel8
- multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/console-mce-rhel9, multicluster-engine/multicluster-engine-console-mce-rhel9
Fixes 5 records
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00459 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-130
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00302 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
Priority MEDIUM 46
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00617 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
Priority MEDIUM 40
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00496 · Published 2024-10-10 · Partial fix · 6.5.6 CWE-347
Priority LOW 27
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file.
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00358 · Published 2024-06-24 · Partial fix · 0.7.7 CWE-532
THREATIST.IORead the docs