RHSA-2024:6738MediumCVSS 8.2

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.5.7 security updates and bug fixes

Published
September 17, 2024
Last Modified
August 18, 2026

🔗 CVE IDs covered (5)

CVE-2024-48949 →CVE-2024-6104 →CVE-2024-42459 →CVE-2024-42460 →CVE-2024-42461 →

📋 Description

CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-42459 — elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check CVE-2024-42460 — elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks CVE-2024-42461 — elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed CVE-2024-48949 — elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

🎯 Affected products170

  • multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:4b0f3d32fe6b84b8cc0230a19ccd28a69e2c30fb514106ca905c2f73f7805a29_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:701a47853d3f5f449ef16af4958bc8a95f1b8f7a11bae0455a12ca1a537b7b74_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:81bda6823df028f91ee0af52822d4d37a74dcf30a8605982f64bf920ca953644_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:d1cfb25aab5d523d101ec9d9e9e417305c35bc19f2e6327c9e5cdeb89592ef0e_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/agent-service-rhel8@sha256:39f0ce4e7b966068f8bf1345a52801696fe9c0fdd7d9ef3c26202d7a0536c943_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:8f359c8af22b3fcee461c5c706b8d781a8fb2a4a34bfa746d53bb9b99f22c231_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:8fa8bf1e1cbe672dbe0c9c16e5f68ff451915a85a7c5473f6dac02e12b683641_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:c3c77df4c09911a5ddf2bc3fd9bae21c4da9b483447c53b5a608d803439bb4b2_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel9@sha256:6ead0206831294f5028680d8b19fb20361e7882136e28b340ab97e91debe9121_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/apiserver-network-proxy-rhel9@sha256:7cf4726cfa7b6f6ea40ab0bcbbce95a936165ce1f0936f1ac9f95dc5a77a0b75_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/apiserver-network-proxy-rhel9@sha256:82a0ad99cb916e785d29c7cab4b34cac699da0c0fed69b36e5c5694632c72f1b_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/apiserver-network-proxy-rhel9@sha256:da461e8c990bb8e95403ed51c387b060764d8692ca3435c01644beff9e5da60c_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel8@sha256:108ad14c4cd817709a1758c55f5573f1e1576e66a6f44d2ff9e8d92692c803d2_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:1a4375360208909a28b239e51a294a1ff88ff85184f88b0dcb735690d6340d9f_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:3356597e1967b1c39efb7fc6adba205d9696ebb71b2b81e593a674ec1c455eb9_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:908f8328b813ec544eec081d7413f7b904373cfc36d88720290e693eaa55a6f9_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:40a60bbeaaaf8e2acc0d8023d00cb1940d83553d2b58edeb9a6f2eb6abd6e863_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:7e5bf991c5ffa56d1cd4bfae9cad4d131b0502206e606c66eea50d6bd462a21e_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:dc86f880e3470dd0e1050e0f89aa690f0e247d8e99b392068693a26a47e68251_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:f89bd3555c1e89b9e3b6e7a4187d41e57481aa5a4d4c488c716a81e4e0fbde09_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:3ac35d57feeb3998d5f74928046a6506e63bccc8fdd9221fcf188ff89a93a52d_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:3d9995ef9f6227620ea48c31d68c2393e27e4e55a22f1b2630c77de85083039c_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:7c6b7a49111ff6eaf76b79d8e91d8ba2535fc1a351ada9e893d0b6eae995a7f5_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:930b2c0d1fed137f0d0e5dc2c52e89ef282ede39531fd6901d449fe92c309ca6_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:1885a89add15c4c358321a3ee13fa597e812867d0156db637b4604e8ca455d47_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:882cb8c6ddcc67b14c7652a01cbf692352bda2f5aa5ee5fc6a184ca0d8e294ff_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:b8d9986ebeacb5453c6b531cb2a7d24004f09ceebba5f0b2788e655d1e4af4b4_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:dc482a3604eaaebcc0d158f78310f5d8d6ad4523fe5a3d522d13c2965e9c5d99_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8
  • +140 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)