CVE-2024-1394 – github.com/golang-fips/openssl/v2

Package

Manager: go
Name: github.com/golang-fips/openssl/v2
Vulnerable Version: >=0 <2.0.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.01021 pctl0.76382

Details

Memory leaks in code encrypting and verifying RSA payloads Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Metadata

Created: 2024-03-20T18:10:36Z
Modified: 2024-10-22T14:21:14Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-78hx-gp6g-7mj6/GHSA-78hx-gp6g-7mj6.json
CWE IDs: ["CWE-400", "CWE-401"]
Alternative ID: GHSA-78hx-gp6g-7mj6
Finding: F067
Auto approve: 1