SB2024121844 - IBM watsonx Assistant for IBM Cloud Pak for Data update for Node.js Elliptic

Security Bulletin ID SB2024121844

Severity

Medium

Patch available

YES

Number of vulnerabilities 3

Exploitation vector Remote access

Highest impact Data manipulation

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42461)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling BER-encoded ECDSA signatures. A remote attacker can bypass signature-based security checks.

2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42460)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling ECDSA signatures. A remote attacker can bypass signature-based security checks.

3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42459)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling EDDSA signatures. A remote attacker can bypass signature-based security checks.

Install update from vendor's website.