GitHub Advisoryadvisory · Go

GHSA-78hx-gp6g-7mj6 Memory leaks in code encrypting and verifying RSA payloads

HIGH Published 2024-03-20 Modified 2024-10-22 Official page ↗
Aliases
CVE-2024-1394
Ecosystem
Go
Packages
github.com/golang-fips/go, github.com/golang-fips/openssl/v2, github.com/microsoft/go-crypto-openssl, github.com/microsoft/go-crypto-openssl/openssl
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-401
Reviewed
2024-03-20

Affected packages

• Go github.com/golang-fips/go: <= 1.22.1 (no fix yet) • Go github.com/golang-fips/openssl/v2: < 2.0.1 → fixed in 2.0.1 • Go github.com/microsoft/go-crypto-openssl: <= 0.2.8 (no fix yet) • Go github.com/microsoft/go-crypto-openssl/openssl: < 0.2.9 → fixed in 0.2.9

Description

Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Related

Alias · CVE (1)

  • CVE-2024-1394 A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References