Red Hat Security AdvisoryRHSA-2024:7759
Multicluster Engine for Kubernetes 2.6.3 security updates
Released 2024-10-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +31
Fixes 3 records
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00459 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-130
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00302 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
Priority MEDIUM 46
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00617 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
