Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• Critical 9.1
  CVE-2024-48949

  Elliptic's verify function omits uniqueness validation

  The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Oct 10, 2024
• Medium 5.3
  CVE-2024-42459

  Elliptic's EDDSA missing signature length check

  In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Aug 2, 2024
• Medium 5.3
  CVE-2024-42460

  Elliptic's ECDSA missing check for whether leading bit of r and s is zero

  In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Aug 2, 2024
• Medium 5.3
  CVE-2024-42461 Public exploit

  Elliptic allows BER-encoded signatures

  In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Aug 2, 2024

Revision history

1. 2025-11-24 #9

   Neue Updates von Red Hat aufgenommen

2. 2024-11-21 #8

   Neue Updates von Red Hat aufgenommen

3. 2024-11-06 #7

   Neue Updates von Red Hat aufgenommen

4. 2024-10-28 #6

   Neue Updates von Red Hat aufgenommen

5. 2024-10-27 #5

   Neue Updates von Red Hat aufgenommen

6. 2024-10-22 #4

   Neue Updates von Red Hat aufgenommen

7. 2024-10-16 #3

   Neue Updates von openSUSE aufgenommen

8. 2024-10-15 #2

   Neue Updates von Fedora aufgenommen

9. 2024-10-10 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2024-10-10
  https://access.redhat.com/errata/RHSA-2024:7994
• Fedora Security Advisory FEDORA-2024-6955BCC801 vom 2024-10-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-6955bcc801
• Fedora Security Advisory FEDORA-2024-B0FC600C3C vom 2024-10-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-b0fc600c3c
• Fedora Security Advisory FEDORA-2024-362915851C vom 2024-10-15
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-362915851c
• Fedora Security Advisory FEDORA-2024-D79685D847 vom 2024-10-15
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-d79685d847
• Fedora Security Advisory FEDORA-2024-66B0BDAD35 vom 2024-10-15
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-66b0bdad35
• Fedora Security Advisory FEDORA-2024-65994E5CBF vom 2024-10-15
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-65994e5cbf
• Fedora Security Advisory FEDORA-EPEL-2024-78DF19AAF3 vom 2024-10-15
  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-78df19aaf3
• openSUSE Security Update OPENSUSE-SU-2024:14403-1 vom 2024-10-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/M7BG5WQRKJLY2OVHOL5KXFLQGUMAI2OC/
• Red Hat Security Advisory RHSA-2024:8351 vom 2024-10-23
  https://access.redhat.com/errata/RHSA-2024:8351
• Red Hat Security Advisory RHSA-2024:8507 vom 2024-10-28
  https://access.redhat.com/errata/RHSA-2024:8507
• Red Hat Security Advisory RHSA-2024:8546 vom 2024-10-28
  https://access.redhat.com/errata/RHSA-2024:8546
• Red Hat Security Advisory RHSA-2024:8533 vom 2024-10-28
  https://access.redhat.com/errata/RHSA-2024:8533
• Red Hat Security Advisory RHSA-2024:8974 vom 2024-11-06
  https://access.redhat.com/errata/RHSA-2024:8974
• Red Hat Security Advisory RHSA-2024:10179 vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10179
• Red Hat Security Advisory RHSA-2024:10183 vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10183
• Red Hat Security Advisory RHSA-2025:8233 vom 2025-11-25
  https://access.redhat.com/errata/RHSA-2025:8233
• Red Hat Security Advisory RHSA-2025:8078 vom 2025-11-25
  https://access.redhat.com/errata/RHSA-2025:8078
• Red Hat Security Advisory RHSA-2025:10853 vom 2025-11-25
  https://access.redhat.com/errata/RHSA-2025:10853
• Red Hat Security Advisory RHSA-2025:9294 vom 2025-11-25
  https://access.redhat.com/errata/RHSA-2025:9294
• Red Hat Security Advisory RHSA-2025:8512 vom 2025-11-25
  https://access.redhat.com/errata/RHSA-2025:8512