CVE-2024-1394

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-1394
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1394.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-1394
Aliases
Downstream
RHSA (36)
RLSA (10)
Related
ALSA (19)
RLSA (1)
Published
2024-03-21T12:16:38Z
Modified
2026-10-22T10:34:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Details

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1394.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0:1.4.5-1.el8ap"
                        },
                        {
                            "fixed": "0:1.4.5-1.el9ap"
                        },
                        {
                            "fixed": "0:1.19.13-6.el7_9"
                        },
                        {
                            "fixed": "8090020240313170136.26eb71ac"
                        },
                        {
                            "fixed": "0:5.1.1-2.el8_9"
                        },
                        {
                            "fixed": "0:9.2.10-8.el8_9"
                        },
                        {
                            "fixed": "0:9.2.10-16.el8_10"
                        },
                        {
                            "fixed": "8100020240808093819.afee755d"
                        },
                        {
                            "fixed": "0:101-2.el8_10"
                        },
                        {
                            "fixed": "0:1.20.12-2.el9_3"
                        },
                        {
                            "fixed": "0:9.2.10-8.el9_3"
                        },
                        {
                            "fixed": "0:5.1.1-2.el9_3"
                        },
                        {
                            "fixed": "0:1.21.9-2.el9_4"
                        },
                        {
                            "fixed": "0:9.2.10-16.el9_4"
                        },
                        {
                            "fixed": "0:5.1.1-2.el9_4"
                        },
                        {
                            "fixed": "2:1.33.7-3.el9_4"
                        },
                        {
                            "fixed": "4:4.9.4-5.el9_4"
                        },
                        {
                            "fixed": "6:0.7.3-4.el9_4"
                        },
                        {
                            "fixed": "2:1.14.3-3.el9_4"
                        },
                        {
                            "fixed": "1:1.4.0-4.el9_4"
                        },
                        {
                            "fixed": "4:1.1.12-3.el9_4"
                        },
                        {
                            "fixed": "0:132-1.el9"
                        },
                        {
                            "fixed": "2:4.2.0-4.el9_0"
                        },
                        {
                            "fixed": "1:1.0.1-6.el9_0"
                        },
                        {
                            "fixed": "0:1.19.13-7.el9_2"
                        },
                        {
                            "fixed": "2:4.4.1-20.el9_2"
                        },
                        {
                            "fixed": "1:1.23.4-5.2.rhaos4.12.el8"
                        },
                        {
                            "fixed": "0:0.16.0-2.2.rhaos4.12.el8"
                        },
                        {
                            "fixed": "1:1.4.0-1.1.rhaos4.12.el8"
                        },
                        {
                            "fixed": "0:1.25.3-5.2.rhaos4.12.git44a2cb2.el9"
                        },
                        {
                            "fixed": "0:1.25.0-2.2.el8"
                        },
                        {
                            "fixed": "0:2.14.0-5.2.rhaos4.12.el9"
                        },
                        {
                            "fixed": "0:4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.2.0-7.2.rhaos4.12.el9"
                        },
                        {
                            "fixed": "3:1.1.6-5.2.rhaos4.12.el8"
                        },
                        {
                            "fixed": "2:1.9.4-3.2.rhaos4.12.el8"
                        },
                        {
                            "fixed": "1:1.29.1-2.2.rhaos4.13.el8"
                        },
                        {
                            "fixed": "1:1.4.0-1.1.rhaos4.13.el8"
                        },
                        {
                            "fixed": "0:1.26.5-11.1.rhaos4.13.git919cc6e.el8"
                        },
                        {
                            "fixed": "0:1.26.0-4.1.el8"
                        },
                        {
                            "fixed": "0:2.15.0-7.1.rhaos4.13.el9"
                        },
                        {
                            "fixed": "0:4.13.0-202404020737.p0.gd192e90.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.4.1-5.2.rhaos4.13.el8"
                        },
                        {
                            "fixed": "4:1.1.12-1.1.rhaos4.13.el8"
                        },
                        {
                            "fixed": "2:1.11.2-2.2.rhaos4.13.el8"
                        },
                        {
                            "fixed": "0:0.19.0-1.3.rhaos4.14.el8"
                        },
                        {
                            "fixed": "1:1.4.0-1.2.rhaos4.14.el8"
                        },
                        {
                            "fixed": "0:1.27.4-6.1.rhaos4.14.gitd09e4c0.el8"
                        },
                        {
                            "fixed": "0:1.27.0-3.1.el8"
                        },
                        {
                            "fixed": "0:2.16.2-2.1.rhaos4.14.el9"
                        },
                        {
                            "fixed": "0:4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.4.1-11.3.rhaos4.14.el8"
                        },
                        {
                            "fixed": "2:1.11.2-10.3.rhaos4.14.el8"
                        },
                        {
                            "fixed": "1:1.29.1-10.4.rhaos4.14.el8"
                        },
                        {
                            "fixed": "0:0.19.0-1.4.rhaos4.14.el8"
                        },
                        {
                            "fixed": "3:2.1.7-3.4.rhaos4.14.el8"
                        },
                        {
                            "fixed": "1:1.4.0-1.3.rhaos4.14.el8"
                        },
                        {
                            "fixed": "0:1.27.4-7.2.rhaos4.14.git082c52f.el8"
                        },
                        {
                            "fixed": "0:1.27.0-3.2.el8"
                        },
                        {
                            "fixed": "0:2.16.2-2.2.rhaos4.14.el9"
                        },
                        {
                            "fixed": "0:4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202404151639.p0.g81558cc.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202404151639.p0.g8926a29.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.14.0-202404151639.p0.g607e2dd.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.4.1-11.4.rhaos4.14.el8"
                        },
                        {
                            "fixed": "4:1.1.12-1.2.rhaos4.14.el8"
                        },
                        {
                            "fixed": "2:1.11.2-10.4.rhaos4.14.el8"
                        },
                        {
                            "fixed": "0:4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9"
                        },
                        {
                            "fixed": "414.92.202407300859-0"
                        },
                        {
                            "fixed": "1:1.29.1-20.3.rhaos4.15.el8"
                        },
                        {
                            "fixed": "0:0.20.0-1.1.rhaos4.15.el8"
                        },
                        {
                            "fixed": "1:1.4.0-1.2.rhaos4.15.el8"
                        },
                        {
                            "fixed": "0:1.28.4-8.rhaos4.15.git24f50b9.el8"
                        },
                        {
                            "fixed": "0:1.28.0-3.1.el8"
                        },
                        {
                            "fixed": "0:2.16.2-2.1.rhaos4.15.el9"
                        },
                        {
                            "fixed": "0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8"
                        },
                        {
                            "fixed": "0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.4.1-21.1.rhaos4.15.el8"
                        },
                        {
                            "fixed": "4:1.1.12-1.1.rhaos4.15.el8"
                        },
                        {
                            "fixed": "2:1.11.2-21.2.rhaos4.15.el8"
                        },
                        {
                            "fixed": "0:4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9"
                        },
                        {
                            "fixed": "415.92.202407191425-0"
                        },
                        {
                            "fixed": "0:3.3.23-16.el8ost"
                        },
                        {
                            "fixed": "0:0.2.1-3.el8ost"
                        },
                        {
                            "fixed": "0:3.4.26-8.el9ost"
                        },
                        {
                            "fixed": "0:0.2.1-3.el9ost"
                        },
                        {
                            "fixed": "v4.16.0-137"
                        },
                        {
                            "fixed": "v4.16.0-38"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/golang-fips/openssl

Affected ranges

Type
GIT
Repo
https://github.com/golang-fips/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
85d31d0d257ce842c8a1e63c4d230ae850348136
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "85d31d0d257ce842c8a1e63c4d230ae850348136"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}
Type
GIT
Repo
https://github.com/microsoft/go-crypto-openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
104fe7f6912788d2ad44602f77a0a0a62f1f259f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "104fe7f6912788d2ad44602f77a0a0a62f1f259f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v2.*
v2.0.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1394.json"