Skip to content
fr Sign in
7.5 High

CVE-2024-1394 Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Description

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.4 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.4 for RHEL 9 Versions not published
Red Hat Developer Tools Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.2 Extended Update Support Versions not published
Red Hat OpenShift Container Platform 4.12 Versions not published
Red Hat OpenShift Container Platform 4.13 Versions not published
Show the 26 other branches
Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.14 414.92 earliest → < 414.92.202407300859-0 414.92.202407300859-0
Red Hat OpenShift Container Platform 4.15 415.92 earliest → < 415.92.202407191425-0 415.92.202407191425-0
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 for RHEL 8 Versions not published
Red Hat OpenStack Platform 17.1 for RHEL 9 Versions not published
RHODF-4.16-RHEL-9 4.16 earliest → < 4.16.0-38 4.16.0-38
NBDE Tang Server Versions not published
OpenShift Developer Tools and Services Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
Red Hat Ansible Automation Platform 1.2 Versions not published
Red Hat Certification for Red Hat Enterprise Linux 8 Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Container Storage 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.1 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Service Interconnect 1 Versions not published
Red Hat Software Collections Versions not published
Red Hat Storage 3 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8

The 21 CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719 Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane) 9.9 Critical CVE-2026-75884 Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups 9.1 Critical CVE-2026-84502 Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod 9.9 Critical CVE-2026-84474 Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match 9.9 Critical
Track this CVE