Bug 2302459 (CVE-2024-42460)

Summary:	CVE-2024-42460 elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, agutierr, alcohan, anjoseph, anpicker, asoldano, bbaranow, bdettelb, bmaxwell, bparees, brainfor, brian.stansberry, caswilli, cdaley, cdewolf, chazlett, ckandaga, cmiranda, darran.lofthouse, dhanak, dkreling, doconnor, dosoudil, dsimansk, ecerquei, erack, fjuma, gkamathe, gmalinko, gotiwari, gparvin, hasun, hkataria, ibek, istudens, ivassile, iweiss, janstey, jcantril, jchui, jfula, jhe, jhorak, jowilson, jprabhak, jrokos, jwendell, kaycoth, kingland, kshier, ktsao, kverlaen, lbainbri, lchilton, lgao, lsharar, matzew, mnovotny, mosmerov, msochure, msvehla, mvyas, nboldt, njean, nwallace, nyancey, ometelka, owatkins, pahickey, pcongius, pdelbell, pesilva, pierdipi, pjindal, pmackay, psrna, ptisnovs, pvasanth, rcernich, rguimara, rhaigner, rhuss, rojacob, rstancel, rstepani, rtaniwa, sdawley, sfeifer, smaestri, syedriko, teagle, tkral, tom.jenkinson, tpopela, twalsh, wtam, xdharmai
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Elliptic NodeJS package where it fails to properly verify the leading bit for the R and S values used in the ECDSA signature. This issue may lead to a scenario where an attacker can modify the signature without the Elliptic library being able to properly reject it, causing data confidentiality issues.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2303537, 2303538, 2303539, 2303540, 2303541, 2303542
Bug Blocks:

Description OSIDB Bzimport 2024-08-02 07:20:39 UTC

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

Comment 1 Alberto Gutierrez 2024-08-14 08:53:43 UTC

https://github.com/indutny/elliptic/pull/317 was merged 6 hours ago bumping th version to the 6.5.7 fixing:

CVE-2024-42459
CVE-2024-42460
CVE-2024-42461

NPM library published https://www.npmjs.com/package/elliptic

Comment 2 errata-xmlrpc 2024-09-17 19:47:45 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.5 for RHEL 8
  multicluster engine for Kubernetes 2.5 for RHEL 9

Via RHSA-2024:6738 https://access.redhat.com/errata/RHSA-2024:6738

Comment 3 errata-xmlrpc 2024-09-18 19:22:28 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9

Via RHSA-2024:6779 https://access.redhat.com/errata/RHSA-2024:6779

Comment 5 errata-xmlrpc 2024-10-07 15:27:55 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.6 for RHEL 9
  multicluster engine for Kubernetes 2.6 for RHEL 8

Via RHSA-2024:7759 https://access.redhat.com/errata/RHSA-2024:7759

Comment 6 errata-xmlrpc 2024-10-11 01:44:40 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9

Via RHSA-2024:7994 https://access.redhat.com/errata/RHSA-2024:7994