GO-2024-2660
Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-1394
- Alias
- GHSA-78hx-gp6g-7mj6
Description
Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/golang-fips/openssl/v2 | introduced 0, fixed 2.0.1 |
| Go · github.com/microsoft/go-crypto-openssl | introduced 0, fixed 0.2.9 |
Références
- https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136 FIX
- https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |