Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/golang-fips/go
  4. ›
  5. CVE-2024-1394

CVE-2024-1394: Memory leaks in code encrypting and verifying RSA payloads

March 20, 2024 (updated October 22, 2024)

Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads.

An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

References

  • access.redhat.com/errata/RHSA-2024:1462
  • access.redhat.com/errata/RHSA-2024:1468
  • access.redhat.com/errata/RHSA-2024:1472
  • access.redhat.com/errata/RHSA-2024:1501
  • access.redhat.com/errata/RHSA-2024:1502
  • access.redhat.com/errata/RHSA-2024:1561
  • access.redhat.com/errata/RHSA-2024:1563
  • access.redhat.com/errata/RHSA-2024:1566
  • access.redhat.com/errata/RHSA-2024:1567
  • access.redhat.com/errata/RHSA-2024:1574
  • access.redhat.com/errata/RHSA-2024:1640
  • access.redhat.com/errata/RHSA-2024:1644
  • access.redhat.com/errata/RHSA-2024:1646
  • access.redhat.com/errata/RHSA-2024:1763
  • access.redhat.com/errata/RHSA-2024:1897
  • access.redhat.com/errata/RHSA-2024:2562
  • access.redhat.com/errata/RHSA-2024:2568
  • access.redhat.com/errata/RHSA-2024:2569
  • access.redhat.com/errata/RHSA-2024:2729
  • access.redhat.com/errata/RHSA-2024:2730
  • access.redhat.com/errata/RHSA-2024:2767
  • access.redhat.com/errata/RHSA-2024:3265
  • access.redhat.com/errata/RHSA-2024:3352
  • access.redhat.com/errata/RHSA-2024:4146
  • access.redhat.com/errata/RHSA-2024:4371
  • access.redhat.com/errata/RHSA-2024:4378
  • access.redhat.com/errata/RHSA-2024:4379
  • access.redhat.com/errata/RHSA-2024:4502
  • access.redhat.com/errata/RHSA-2024:4581
  • access.redhat.com/errata/RHSA-2024:4591
  • access.redhat.com/errata/RHSA-2024:4672
  • access.redhat.com/errata/RHSA-2024:4699
  • access.redhat.com/errata/RHSA-2024:4761
  • access.redhat.com/errata/RHSA-2024:4762
  • access.redhat.com/errata/RHSA-2024:4960
  • access.redhat.com/errata/RHSA-2024:5258
  • access.redhat.com/errata/RHSA-2024:5634
  • access.redhat.com/errata/RHSA-2024:7262
  • access.redhat.com/security/cve/CVE-2024-1394
  • bugzilla.redhat.com/show_bug.cgi?id=2262921
  • github.com/advisories/GHSA-78hx-gp6g-7mj6
  • github.com/golang-fips/openssl
  • github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
  • github.com/golang-fips/openssl/releases/tag/v2.0.1
  • github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
  • github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
  • github.com/microsoft/go-crypto-openssl/releases/tag/v0.2.9
  • nvd.nist.gov/vuln/detail/CVE-2024-1394
  • pkg.go.dev/vuln/GO-2024-2660
  • vuln.go.dev/ID/GO-2024-2660.json

Code Behaviors & Features

Detect and mitigate CVE-2024-1394 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 1.22.1

Solution

Unfortunately, there is no solution available yet.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-401: Missing Release of Memory after Effective Lifetime

Source file

go/github.com/golang-fips/go/CVE-2024-1394.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:22 +0000.