~ / search / GHSA-78hx-gp6g-7mj6

GHSA-78hx-gp6g-7mj6

Memory leaks in code encrypting and verifying RSA payloads

Source: GitHub Advisory Database (reviewed) High CVE-2024-1394

Packages

EcosystemPackageAffectedFixed in
Go github.com/golang-fips/go <= 1.22.1 no fix listed
Go github.com/golang-fips/openssl/v2 < 2.0.1 2.0.1
Go github.com/microsoft/go-crypto-openssl <= 0.2.8 no fix listed
Go github.com/microsoft/go-crypto-openssl/openssl < 0.2.9 0.2.9

Details

As written in the advisory (Markdown source, shown as plain text).

Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

References

External links from the advisory. They lead to third-party sites.