CVE-2024-48949

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the order n of the base point of the elliptic curve, leading to signature malleability. Namely, the verify function in lib/elliptic/eddsa/index.js omits sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg() validation.

This vulnerability could have a security-relevant impact if an application relies on the uniqueness of a signature.

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

TuxCare rebuilt elliptic to address 9 CVEs. Fixed in 6.4.1-tuxcare.1.

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.4-tuxcare.1.

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.5-tuxcare.1.

TuxCare rebuilt elliptic to address 6 CVEs. Fixed in 6.5.1-tuxcare.2.

TuxCare rebuilt elliptic to address 5 CVEs. Fixed in 6.5.3-tuxcare.2.

CVE-2024-37890 yarnpkg: denial of service when handling a request with many HTTP headers. CVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature Verification. CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file And other vulnerabilities in the yarn's bundled nodejs components are fixed too, see the references.

These are all security issues fixed in the python310-pytest-html-4.1.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-pytest-html-4.2.0-4.1 package on the GA media of openSUSE Tumbleweed.

This update for pgadmin4 fixes the following issues:

• CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
• CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
• CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
• CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
• CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
• CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
• CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
• CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
• CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
• CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)

This update for aws-cli, local-npm-registry, python-boto3, python-botocore, python-coverage, python-flaky, python-pluggy, python-pytest, python-pytest-cov, python-pytest-html, python-pytest-metadata, python-pytest-mock contains the following fixes:

Changes in aws-cli:

• Update to 1.33.26
  • api-change:acm-pca: Minor refactoring of C2J model for AWS Private CA
  • api-change:arc-zonal-shift: Adds the option to subscribe to get notifications when a zonal autoshift occurs in a region.
  • api-change:globalaccelerator: This feature adds exceptions to the Customer API to avoid throwing Internal Service errors
  • api-change:pinpoint: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:quicksight: Vega ally control options and Support for Reviewed Answers in Topics
• from version 1.33.25
  • api-change:batch: This feature allows AWS Batch Jobs with EKS container orchestration type to be run as Multi-Node Parallel Jobs.
  • api-change:bedrock: Add support for contextual grounding check for Guardrails for Amazon Bedrock.
  • api-change:bedrock-agent: Introduces new data sources and chunking strategies for Knowledge bases, advanced parsing logic using FMs, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources.
  • api-change:bedrock-agent-runtime: Introduces query decomposition, enhanced Agents integration with Knowledge bases, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources for end-to-end solutions.
  • api-change:bedrock-runtime: Add support for contextual grounding check and ApplyGuardrail API for Guardrails for Amazon Bedrock.
  • api-change:ec2: Add parameters to enable provisioning IPAM BYOIPv4 space at a Local Zone Network Border Group level
  • api-change:glue: Add recipe step support for recipe node
  • api-change:groundstation: Documentation update specifying OEM ephemeris units of measurement
  • api-change:license-manager-linux-subscriptions: Add support for third party subscription providers, starting with RHEL subscriptions through Red Hat Subscription Manager (RHSM). Additionally, add support for tagging subscription provider resources, and detect when an instance has more than one Linux subscription and notify the customer.
  • api-change:mediaconnect: AWS Elemental MediaConnect introduces the ability to disable outputs. Disabling an output allows you to keep the output attached to the flow, but stop streaming to the output destination. A disabled output does not incur data transfer costs.
• from version 1.33.24
  • api-change:datazone: This release deprecates dataProductItem field from SearchInventoryResultItem, along with some unused DataProduct shapes
  • api-change:fsx: Adds support for FSx for NetApp ONTAP 2nd Generation file systems, and FSx for OpenZFS Single AZ HA file systems.
  • api-change:opensearch: This release adds support for enabling or disabling Natural Language Query Processing feature for Amazon OpenSearch Service domains, and provides visibility into the current state of the setup or tear-down.
  • api-change:sagemaker: This release 1/ enables optimization jobs that allows customers to perform Ahead-of-time compilation and quantization. 2/ allows customers to control access to Amazon Q integration in SageMaker Studio. 3/ enables AdditionalModelDataSources for CreateModel action.
• from version 1.33.23
  • api-change:codedeploy: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:devicefarm: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:dms: Add v2 smoke…