CVE-2024-1394

{"id": "CVE-2024-1394", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-03-21T13:00:08.037", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1462", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1468", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1472", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1501", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1502", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1561", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1563", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1566", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1567", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1574", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1640", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1644", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1646", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1763", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1897", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2562", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2568", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2569", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2729", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2730", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2767", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3265", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3352", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4146", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4371", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4378", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4379", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4502", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4581", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4591", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4672", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4699", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4761", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4762", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4960", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5258", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:5634", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:7262", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2025:7118", "source": "[email protected]"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1394", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262921", "source": "[email protected]"}, {"url": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136", "source": "[email protected]"}, {"url": "https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6", "source": "[email protected]"}, {"url": "https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f", "source": "[email protected]"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2660", "source": "[email protected]"}, {"url": "https://vuln.go.dev/ID/GO-2024-2660.json", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1462", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1468", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1472", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1501", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1502", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1561", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1563", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1566", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1567", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1574", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1640", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1644", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1646", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1763", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1897", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2562", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2568", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2569", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2729", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2730", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2767", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3265", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3352", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4146", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4371", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4378", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4379", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4502", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4581", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4591", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4672", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4699", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4761", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4762", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1394", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262921", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2660", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuln.go.dev/ID/GO-2024-2660.json", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs\u200b. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey\u200b and ctx\u200b. That function uses named return parameters to free pkey\u200b and ctx\u200b if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the \"return nil, nil, fail(...)\" pattern, meaning that pkey\u200b and ctx\u200b will be nil inside the deferred function that should free them."}, {"lang": "es", "value": "Se encontr\u00f3 una falla de p\u00e9rdida de memoria en Golang en el c\u00f3digo de cifrado/descifrado RSA, lo que podr\u00eda conducir a una vulnerabilidad de agotamiento de recursos mediante entradas controladas por el atacante. La p\u00e9rdida de memoria ocurre en github.com/golang-fips/openssl/openssl/rsa.go#L113. Los objetos filtrados son pkey? y ctx?. Esa funci\u00f3n utiliza par\u00e1metros de retorno con nombre para liberar pkey? y ctx? si hay un error al inicializar el contexto o al configurar las diferentes propiedades. Todas las declaraciones de devoluci\u00f3n relacionadas con casos de error siguen el patr\u00f3n \"return nil, nil, fail(...)\", lo que significa que pkey? y ctx? ser\u00e1n nulos dentro de la funci\u00f3n diferida que deber\u00eda liberarlos."}], "lastModified": "2025-05-13T09:15:19.360", "sourceIdentifier": "[email protected]"}