Red Hat JBossEAP: Improper Verification of Cryptographic Signature (CVE-2024-42459)

Red Hat JBossEAP: Improper Verification of Cryptographic Signature (CVE-2024-42459)

Severity

5

CVSS

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Published

08/02/2024

Created

09/20/2024

Added

09/19/2024

Modified

12/20/2024

Description

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.. A flaw was found in the NodeJS Elliptic package. When creating EDDSA signatures, the Elliptic package doesn't properly check the signature length, allowing zeros to be added or removed from the signature without invalidating it, which may result in confidentiality issues.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-42459
• CVE - 2024-42459
• https://access.redhat.com/security/cve/CVE-2024-42459
• https://bugzilla.redhat.com/show_bug.cgi?id=2302458
• https://github.com/indutny/elliptic/pull/317