Vulnerability · Published Mar 21, 2024 · Assigned by redhat
CVE-2024-1394Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
High 7.5
In plain English
A high-severity memory leak in Red Hat Ansible Automation Platform 2.4 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:5258 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | buildah | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | buildah | 2:1.33.7-3.el9_4 | ALSA-2024:4371 |
| AlmaLinux:8 | buildah-tests | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | buildah-tests | 2:1.33.7-3.el9_4 | ALSA-2024:4371 |
| AlmaLinux:8 | cockpit-podman | 84.1-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | containernetworking-plugins | 1:1.4.0-4.el9_4 | ALSA-2024:4761 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 | ALSA-2024:1472 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:5258 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3859+6ae70a0e | ALSA-2024:5258 |
| AlmaLinux:8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f | ALSA-2024:1472 |
| AlmaLinux:9 | go-toolset | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:9 | go-toolset | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:8 | golang | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:9 | golang | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:8 | golang-bin | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang-bin | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:9 | golang-bin | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:8 | golang-docs | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang-docs | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:9 | golang-docs | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:8 | golang-misc | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang-misc | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:9 | golang-misc | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:8 | golang-src | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang-src | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:9 | golang-src | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:8 | golang-tests | 1.20.12-3.module_el8.9.0+3750+10f4110d | ALSA-2024:1472 |
| AlmaLinux:9 | golang-tests | 1.21.9-2.el9_4 | ALSA-2024:2562 |
| AlmaLinux:9 | golang-tests | 1.20.12-2.el9_3 | ALSA-2024:1462 |
| AlmaLinux:8 | grafana | 9.2.10-8.el8_9.alma.1 | ALSA-2024:1646 |
| AlmaLinux:8 | grafana | 9.2.10-16.el8_10 | ALSA-2024:3265 |
| AlmaLinux:9 | grafana | 9.2.10-8.el9_3.alma.1 | ALSA-2024:1501 |
| AlmaLinux:9 | grafana | 9.2.10-16.el9_4.alma.1 | ALSA-2024:2568 |
| AlmaLinux:8 | grafana-pcp | 5.1.1-2.el8_9.alma.1 | ALSA-2024:1644 |
| AlmaLinux:9 | grafana-pcp | 5.1.1-2.el9_3.alma.1 | ALSA-2024:1502 |
| AlmaLinux:9 | grafana-pcp | 5.1.1-2.el9_4.alma.1 | ALSA-2024:2569 |
| AlmaLinux:8 | grafana-selinux | 9.2.10-16.el8_10 | ALSA-2024:3265 |
| AlmaLinux:9 | grafana-selinux | 9.2.10-16.el9_4.alma.1 | ALSA-2024:2568 |
| AlmaLinux:9 | gvisor-tap-vsock | 6:0.7.3-4.el9_4.alma.1 | ALSA-2024:4379 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:5258 |
| AlmaLinux:9 | osbuild | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer | 101-2.el8_10.alma.1 | ALSA-2024:7262 |
| AlmaLinux:9 | osbuild-composer | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer-core | 101-2.el8_10.alma.1 | ALSA-2024:7262 |
| AlmaLinux:9 | osbuild-composer-core | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer-worker | 101-2.el8_10.alma.1 | ALSA-2024:7262 |
| AlmaLinux:9 | osbuild-composer-worker | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-depsolve-dnf | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-luks2 | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-lvm2 | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-ostree | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-selinux | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | podman | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | podman | 4:4.9.4-5.el9_4 | ALSA-2024:4378 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | podman-docker | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | podman-docker | 4:4.9.4-5.el9_4 | ALSA-2024:4378 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | podman-plugins | 4:4.9.4-5.el9_4 | ALSA-2024:4378 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | podman-remote | 4:4.9.4-5.el9_4 | ALSA-2024:4378 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-12.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | podman-tests | 4:4.9.4-5.el9_4 | ALSA-2024:4378 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | python3-osbuild | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | python3-podman | 4.9.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | runc | 1:1.1.12-4.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | runc | 4:1.1.12-3.el9_4 | ALSA-2024:4762 |
| AlmaLinux:8 | skopeo | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | skopeo | 2:1.14.3-3.el9_4 | ALSA-2024:4502 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:9 | skopeo-tests | 2:1.14.3-3.el9_4 | ALSA-2024:4502 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:5258 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:5258 |
| AlmaLinux:8 | udica | 0.2.6-21.module_el8.10.0+3858+6ad51f9f | ALSA-2024:5258 |
| Go | github.com/golang-fips/go | no fix listed | GHSA-78hx-gp6g-7mj6 |
| Go | github.com/golang-fips/openssl/v2 | 2.0.1 | GO-2024-2660 |
| Go | github.com/golang-fips/openssl/v2 | 2.0.1 | GHSA-78hx-gp6g-7mj6 |
| Go | github.com/microsoft/go-crypto-openssl | 0.2.9 | GO-2024-2660 |
| Go | github.com/microsoft/go-crypto-openssl | no fix listed | GHSA-78hx-gp6g-7mj6 |
| Go | github.com/microsoft/go-crypto-openssl/openssl | 0.2.9 | GHSA-78hx-gp6g-7mj6 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | buildah | 2:1.33.8-4.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.4.0-5.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | delve | 0:1.20.2-1.module+el8.9.0+1392+c9f6376a | RLSA-2024:1472 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | go-toolset | 0:1.20.12-1.module+el8.9.0+1725+0ed4fa7f | RLSA-2024:1472 |
| Rocky Linux:8 | golang | 0:1.20.12-3.module+el8.9.0+1764+12d15796 | RLSA-2024:1472 |
| Rocky Linux:8 | grafana | 0:9.2.10-16.el8_10 | RLSA-2024:3265 |
| Rocky Linux:8 | grafana | 0:9.2.10-8.el8_9 | RLSA-2024:1646 |
| Rocky Linux:9 | grafana | 0:9.2.10-16.el9_4 | RLSA-2024:2568 |
| Rocky Linux:8 | grafana-pcp | 0:5.1.1-2.el8_9 | RLSA-2024:1644 |
| Rocky Linux:9 | grafana-pcp | 0:5.1.1-2.el9_3 | RLSA-2024:1502 |
| Rocky Linux:9 | grafana-pcp | 0:5.1.1-2.el9_3 | RLSA-2024:2569 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | osbuild-composer | 0:101-2.el8_10.rocky.0.6 | RLSA-2024:7262 |
| Rocky Linux:8 | podman | 4:4.9.4-12.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | python-podman | 0:4.9.0-2.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | runc | 1:1.1.12-4.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:8 | skopeo | 2:1.14.5-3.module+el8.10.0+1843+6892ab28 | RLSA-2024:5258 |
| Rocky Linux:9 | skopeo | 2:1.14.3-3.el9_4 | RLSA-2024:4502 |
| Rocky Linux:8 | slirp4netns | 0:1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
| Rocky Linux:8 | toolbox | 0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:5258 |
| Rocky Linux:8 | udica | 0:0.2.6-21.module+el8.10.0+1815+5fe7415e | RLSA-2024:5258 |
Affected products (as reported)
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2024:1462 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1468 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1472 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1501 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1502 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1561 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1563 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1566 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1567 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1574 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1640 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1644 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1646 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1763 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1897 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2562 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2568 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2569 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2729 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2730 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2767 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:3265 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:3352 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4146 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4371 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4378 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4379 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4502 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4581 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4591 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4672 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4699 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4761 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4762 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4960 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:5258 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:5634 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:7262 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7118 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-1394 vdb-entry, x_refsource_REDHAT