RHSA-2024:8533HighCVSS 8.2

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.4.6 security updates and bug fixes

Published
October 28, 2024
Last Modified
August 26, 2026

🔗 CVE IDs covered (4)

CVE-2024-42460 →CVE-2024-42461 →CVE-2024-48949 →CVE-2024-42459 →

📋 Description

CVE-2024-42459 — elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check CVE-2024-42460 — elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks CVE-2024-42461 — elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed CVE-2024-48949 — elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

🎯 Affected products161

  • multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:25f852def9fa13a3158edf92606558779d2cbc331b3e6f0687cc7e9b4dfec921_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:7f9543bec9e12e9815af1b9532f52a970065ca5a45a4601423d3270ccd832411_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:a539122dbbf0fe488ff31f962dccdd93e3057a6c41ed840f1b11a25c09f5ab05_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:fb65eaee1a06ac6adfee67ec3a2e31eef8d582fa719802cc473ab90bbb431b8c_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:1fbfb5c43abd2ec6328535d99ca9b7ea8511132977f34b55ecb22e12d775cb64_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:3777d632ce46b0efe4567b3797cd84d43e02ad4248f6b287a226285ef40916eb_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:c27bbe7e9e999c60a534a2f7f92d7f93011f4d27c185eb670c271e51b41a9a56_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:dd5f87a927c960f7e48383f5542688b2bac99dc6b94aa1794ed96bc2475523f3_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:6c102f96331f947f376e609b9f91def2d91efa7f0729bc5cf99e6354e867f0ab_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:b2a1f02b191a8306392f7e41bdeee3bf60b5954ebad1a6af50a07f96e8449ace_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:efdc2d6aa1b3ec251a6a179d2f0383a1c761dd9b7b20d4338ffa31b83918d0ab_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:ff8fa6b8ce2560e7ddc7996dbd1a63dea77b6cbba87bdd5f7b19bc22011b0a37_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:5892ec3e56c705b0235653feb7180e6e5d9136f2fc26432587d543c0cb1491ce_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:9b81cd0f9ef6d21e93bf0a5b9540a3c614a2d9ea859355d16b60c08afbf4ed45_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:d3023c6557f01e032d9390ff7491706d5c8e14c727d95c7e3f84539e0095c7e8_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:f236b86721f158f8f2df0b3ca7afe8ff6ebc28b095719d645d049a31b382f44a_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:1c0905169d9aaf101682b1a94075f63328beeeabeada0a193c55ca027f6dbfb9_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:2380efc08c75017bdcbfb4dc2e6a73d75d0410fc725ade4c9693ef7e56c22aae_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:5f3b70082e096952b4844023326f12c07623583d8eb7befb22fb7eee4b4ea611_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:7f5c178ab6f3d86a310f820bc9fce54cf603c608875fcf06c870472596522d3c_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:0cbc060d5534aa9ee28d4cdea6690a3bbeb1bc9cb4c63c8af42d172dd6d73347_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:172ad428bae3d66b3bc14b9acb2ca73578711780418a861d9464730cc304a6ba_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:3cbad853a9cf20a938cf5b68a65969dc5d8670f3cc873c6c1643f08634dc5d30_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:e9d34ead9f246d69546c75fc9f4b30420a85fd5ecd3d99868525308d7f3786b2_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:21854dd8f7720d68574a457398a70372caa0f561bf9740531f1eeab4c341b51e_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:5cf48ae66bb88d3ba5bd72f5214905e8dab32b04340cc0b622e02a37826d3913_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:7ab88ceddced2dafa9476233589d12a2de726e80d473e963872191a2288d3d24_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:dae85f14672127cb978923116e3da57e08f7a84761d62006a58f7b29631aa4ee_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:13fc46635601769aa43102dffc10479bc271d29a03ec1fc3c1e8c0ecea3654b2_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • +131 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html/clusters/install_upgrade/installing-while-connected-online-mce Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (3)