Red Hat JBossEAP: Improper Verification of Cryptographic Signature (CVE-2024-42461)

Red Hat JBossEAP: Improper Verification of Cryptographic Signature (CVE-2024-42461)

Severity

5

CVSS

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Published

08/02/2024

Created

09/20/2024

Added

09/19/2024

Modified

12/20/2024

Description

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.. A flaw was found in the Elliptic package for Node.js. ECDSA signatures encoded in BER format are improperly validated, allowing leading zeros to be added to the signature without invalidating it, resulting in confidentiality issues.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-42461
• CVE - 2024-42461
• https://access.redhat.com/security/cve/CVE-2024-42461
• https://bugzilla.redhat.com/show_bug.cgi?id=2302460
• https://github.com/indutny/elliptic/pull/317