CVE-2024-48948

The Elliptic prior to 6.6.0 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

TuxCare rebuilt elliptic to address 9 CVEs. Fixed in 6.4.1-tuxcare.1.

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.4-tuxcare.1.

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.5-tuxcare.1.

TuxCare rebuilt elliptic to address 6 CVEs. Fixed in 6.5.1-tuxcare.2.

TuxCare rebuilt elliptic to address 5 CVEs. Fixed in 6.5.3-tuxcare.2.

These are all security issues fixed in the python310-pytest-html-4.1.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-pytest-html-4.2.0-4.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2024-48948 in the elliptic package for Root:npm. Multiple fixed versions available.

This update for pgadmin4 fixes the following issues:

• CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
• CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
• CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
• CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
• CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
• CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
• CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
• CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
• CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
• CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)

This update for aws-cli, local-npm-registry, python-boto3, python-botocore, python-coverage, python-flaky, python-pluggy, python-pytest, python-pytest-cov, python-pytest-html, python-pytest-metadata, python-pytest-mock contains the following fixes:

Changes in aws-cli:

• Update to 1.33.26
  • api-change:acm-pca: Minor refactoring of C2J model for AWS Private CA
  • api-change:arc-zonal-shift: Adds the option to subscribe to get notifications when a zonal autoshift occurs in a region.
  • api-change:globalaccelerator: This feature adds exceptions to the Customer API to avoid throwing Internal Service errors
  • api-change:pinpoint: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:quicksight: Vega ally control options and Support for Reviewed Answers in Topics
• from version 1.33.25
  • api-change:batch: This feature allows AWS Batch Jobs with EKS container orchestration type to be run as Multi-Node Parallel Jobs.
  • api-change:bedrock: Add support for contextual grounding check for Guardrails for Amazon Bedrock.
  • api-change:bedrock-agent: Introduces new data sources and chunking strategies for Knowledge bases, advanced parsing logic using FMs, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources.
  • api-change:bedrock-agent-runtime: Introduces query decomposition, enhanced Agents integration with Knowledge bases, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources for end-to-end solutions.
  • api-change:bedrock-runtime: Add support for contextual grounding check and ApplyGuardrail API for Guardrails for Amazon Bedrock.
  • api-change:ec2: Add parameters to enable provisioning IPAM BYOIPv4 space at a Local Zone Network Border Group level
  • api-change:glue: Add recipe step support for recipe node
  • api-change:groundstation: Documentation update specifying OEM ephemeris units of measurement
  • api-change:license-manager-linux-subscriptions: Add support for third party subscription providers, starting with RHEL subscriptions through Red Hat Subscription Manager (RHSM). Additionally, add support for tagging subscription provider resources, and detect when an instance has more than one Linux subscription and notify the customer.
  • api-change:mediaconnect: AWS Elemental MediaConnect introduces the ability to disable outputs. Disabling an output allows you to keep the output attached to the flow, but stop streaming to the output destination. A disabled output does not incur data transfer costs.
• from version 1.33.24
  • api-change:datazone: This release deprecates dataProductItem field from SearchInventoryResultItem, along with some unused DataProduct shapes
  • api-change:fsx: Adds support for FSx for NetApp ONTAP 2nd Generation file systems, and FSx for OpenZFS Single AZ HA file systems.
  • api-change:opensearch: This release adds support for enabling or disabling Natural Language Query Processing feature for Amazon OpenSearch Service domains, and provides visibility into the current state of the setup or tear-down.
  • api-change:sagemaker: This release 1/ enables optimization jobs that allows customers to perform Ahead-of-time compilation and quantization. 2/ allows customers to control access to Amazon Q integration in SageMaker Studio. 3/ enables AdditionalModelDataSources for CreateModel action.
• from version 1.33.23
  • api-change:codedeploy: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:devicefarm: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:dms: Add v2 smoke…