Medium WID-SEC-2024-1799 3 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Aug 7, 2024 · Updated Mar 2, 2025 · Revision 2 · de-DE

Vendor: IBM Product: App Connect Enterprise Product: Cognos Analytics

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 3

Medium 5.3

CVE-2024-42459

Elliptic's EDDSA missing signature length check

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024
Medium 5.3

CVE-2024-42460

Elliptic's ECDSA missing check for whether leading bit of r and s is zero

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024
Medium 5.3

CVE-2024-42461 Public exploit

Elliptic allows BER-encoded signatures

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024

Revision history

2025-03-02 #2
Neue Updates von IBM aufgenommen
2024-08-07 #1
Initiale Fassung

References

IBM Security Bulletin vom 2024-08-07
https://www.ibm.com/support/pages/node/7163968
IBM Security Bulletin 7184429 vom 2025-03-02
https://www.ibm.com/support/pages/node/7184429
IBM Security Bulletin 7184430 vom 2025-03-02
https://www.ibm.com/support/pages/node/7184430