RHSA-2024:6738: Moderate: Multicluster Engine for Kubernetes 2.5.7 security updates and bug fixes

Multicluster engine for Kubernetes v2.5.7 images<br>Multicluster engine for Kubernetes provides the foundational components<br>that are necessary for the centralized management of multiple<br>Kubernetes-based clusters across data centers, public clouds, and private<br>clouds.<br>You can use the engine to create new Red Hat OpenShift Container Platform<br>clusters or to bring existing Kubernetes-based clusters under management by<br>importing them. After the clusters are managed, you can use the APIs that<br>are provided by the engine to distribute configuration based on placement<br>policy.<br>Security fix(es):<br>CVE-2024-42459 nodejs/elliptic: EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended<br>CVE-2024-42460 nodejs/elliptic: ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero<br>CVE-2024-42461 nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed <br>CVE-2024-6104 go-retryable<a href="http:" target="blank">http:</a> url might write sensitive information to log file

— Red Hat