← CVE Intelligence

CVE-2024-1394

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads PUBLISHED

Description (CNA)

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 8unaffected 0:1.4.5-1.el8ap before *
Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 9unaffected 0:1.4.5-1.el9ap before *
Red Hat / Red Hat Developer Toolsunaffected 0:1.19.13-6.el7_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 8090020240313170136.26eb71ac before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:5.1.1-2.el8_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:9.2.10-8.el8_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:9.2.10-16.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 8100020240808093819.afee755d before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:101-2.el8_10 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:1.20.12-2.el9_3 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:9.2.10-8.el9_3 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:5.1.1-2.el9_3 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:1.21.9-2.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:9.2.10-16.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:5.1.1-2.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 2:1.33.7-3.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 4:4.9.4-5.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 6:0.7.3-4.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 2:1.14.3-3.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 1:1.4.0-4.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 4:1.1.12-3.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:132-1.el9 before *
Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 2:4.2.0-4.el9_0 before *
Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 1:1.0.1-6.el9_0 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 0:1.19.13-7.el9_2 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 2:4.4.1-20.el9_2 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1:1.23.4-5.2.rhaos4.12.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 0:0.16.0-2.2.rhaos4.12.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1:1.4.0-1.1.rhaos4.12.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 0:1.25.3-5.2.rhaos4.12.git44a2cb2.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 0:1.25.0-2.2.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 0:2.14.0-5.2.rhaos4.12.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 0:4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 3:4.2.0-7.2.rhaos4.12.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 3:1.1.6-5.2.rhaos4.12.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 2:1.9.4-3.2.rhaos4.12.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1:1.29.1-2.2.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1:1.4.0-1.1.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 0:1.26.5-11.1.rhaos4.13.git919cc6e.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 0:1.26.0-4.1.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 0:2.15.0-7.1.rhaos4.13.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 0:4.13.0-202404020737.p0.gd192e90.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 3:4.4.1-5.2.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 4:1.1.12-1.1.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 2:1.11.2-2.2.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:0.19.0-1.3.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1:1.4.0-1.2.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:1.27.4-6.1.rhaos4.14.gitd09e4c0.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:1.27.0-3.1.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:2.16.2-2.1.rhaos4.14.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 3:4.4.1-11.3.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 2:1.11.2-10.3.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1:1.29.1-10.4.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:0.19.0-1.4.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 3:2.1.7-3.4.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1:1.4.0-1.3.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:1.27.4-7.2.rhaos4.14.git082c52f.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:1.27.0-3.2.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:2.16.2-2.2.rhaos4.14.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404151639.p0.g81558cc.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404151639.p0.g8926a29.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.0-202404151639.p0.g607e2dd.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 3:4.4.1-11.4.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 4:1.1.12-1.2.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 2:1.11.2-10.4.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 0:4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 414.92.202407300859-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1:1.29.1-20.3.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:0.20.0-1.1.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1:1.4.0-1.2.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:1.28.4-8.rhaos4.15.git24f50b9.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:1.28.0-3.1.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:2.16.2-2.1.rhaos4.15.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 3:4.4.1-21.1.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 4:1.1.12-1.1.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 2:1.11.2-21.2.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 0:4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 415.92.202407191425-0 before *
Red Hat / Red Hat OpenStack Platform 16.2unaffected 0:3.3.23-16.el8ost before *
Red Hat / Red Hat OpenStack Platform 17.1 for RHEL 8unaffected 0:0.2.1-3.el8ost before *
Red Hat / Red Hat OpenStack Platform 17.1 for RHEL 9unaffected 0:3.4.26-8.el9ost before *
Red Hat / Red Hat OpenStack Platform 17.1 for RHEL 9unaffected 0:0.2.1-3.el9ost before *
Red Hat / RHODF-4.16-RHEL-9unaffected v4.16.0-137 before *
Red Hat / RHODF-4.16-RHEL-9unaffected v4.16.0-38 before *
Red Hat / NBDE Tang Serveraffected
Red Hat / OpenShift Developer Tools and Servicesaffected
Red Hat / OpenShift Developer Tools and Servicesaffected
Red Hat / OpenShift Pipelinesunaffected
Red Hat / OpenShift Serverlessaffected
Red Hat / Red Hat Ansible Automation Platform 1.2affected
Red Hat / Red Hat Ansible Automation Platform 1.2affected
Red Hat / Red Hat Certification for Red Hat Enterprise Linux 8affected
Red Hat / Red Hat Certification Program for Red Hat Enterprise Linux 9affected

CWE

CWE-401

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.