GHSA-78hx-gp6g-7mj6

Memory leaks in code encrypting and verifying RSA payloads

En bref

Publiée
Mise à jour
CVE
CVE-2024-1394
Alias
GO-2024-2660
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Paquets affectés

PaquetVersions
Go · github.com/golang-fips/gointroduced 0, last affected 1.22.1
Go · github.com/golang-fips/openssl/v2introduced 0, fixed 2.0.1
Go · github.com/microsoft/go-crypto-opensslintroduced 0, last affected 0.2.8
Go · github.com/microsoft/go-crypto-openssl/opensslintroduced 0, fixed 0.2.9

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database