Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2024-1394

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 1.53 % · percentile 75 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Description

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Weaknesses (CWE)

  • CWE-401 — Missing Release of Memory after Effective Lifetime

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)

Advisories

European references

CERT-FR advisories

Affected products

ProductVersions
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8unaffected 0:1.4.5-1.el8ap < *
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9unaffected 0:1.4.5-1.el9ap < *
Red Hat · Red Hat Developer Toolsunaffected 0:1.19.13-6.el7_9 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8090020240313170136.26eb71ac < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:5.1.1-2.el8_9 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:9.2.10-8.el8_9 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:9.2.10-16.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8100020240808093819.afee755d < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:101-2.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:1.20.12-2.el9_3 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.2.10-8.el9_3 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:5.1.1-2.el9_3 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:1.21.9-2.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.2.10-16.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:5.1.1-2.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 2:1.33.7-3.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 4:4.9.4-5.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 6:0.7.3-4.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 2:1.14.3-3.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 1:1.4.0-4.el9_4 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD