Skip to content
Fencer Vulns
high 7.5

CVE-2024-1394 json

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

published 2024-03-20 2 y ago modified 2026-11-04 4 d ago also GHSA-78hx-gp6g-7mj6 , GO-2024-2660 , EUVD-2024-0854

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Patch / fix

  • go github.com/golang-fips/openssl/v2 2.0.1
  • go github.com/microsoft/go-crypto-openssl 0.2.9
  • go github.com/microsoft/go-crypto-openssl/openssl 0.2.9
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:1.4.5-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:1.4.5-1.el9ap
  • Red Hat Red Hat Developer Tools 0:1.19.13-6.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:5.1.1-2.el8_9, 0:9.2.10-8.el8_9, 0:9.2.10-16.el8_10, 0:101-2.el8_10, 8090020240313170136.26eb71ac, 8100020240808093819.afee755d
  • Red Hat Red Hat Enterprise Linux 9 0:1.20.12-2.el9_3, 0:1.21.9-2.el9_4, 0:5.1.1-2.el9_3, 0:5.1.1-2.el9_4, 0:9.2.10-8.el9_3, 0:9.2.10-16.el9_4, 0:132-1.el9, 1:1.4.0-4.el9_4, 2:1.14.3-3.el9_4, 2:1.33.7-3.el9_4, 4:1.1.12-3.el9_4, 4:4.9.4-5.el9_4, 6:0.7.3-4.el9_4
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 1:1.0.1-6.el9_0, 2:4.2.0-4.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:1.19.13-7.el9_2, 2:4.4.1-20.el9_2
  • Red Hat Red Hat OpenShift Container Platform 4.12 0:0.16.0-2.2.rhaos4.12.el8, 0:1.25.0-2.2.el8, 0:1.25.3-5.2.rhaos4.12.git44a2cb2.el9, 0:2.14.0-5.2.rhaos4.12.el9, 0:4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8, 1:1.4.0-1.1.rhaos4.12.el8, 1:1.23.4-5.2.rhaos4.12.el8, 2:1.9.4-3.2.rhaos4.12.el8, 3:1.1.6-5.2.rhaos4.12.el8, 3:4.2.0-7.2.rhaos4.12.el9
  • Red Hat Red Hat OpenShift Container Platform 4.13 0:1.26.0-4.1.el8, 0:1.26.5-11.1.rhaos4.13.git919cc6e.el8, 0:2.15.0-7.1.rhaos4.13.el9, 0:4.13.0-202404020737.p0.gd192e90.assembly.stream.el8, 1:1.4.0-1.1.rhaos4.13.el8, 1:1.29.1-2.2.rhaos4.13.el8, 2:1.11.2-2.2.rhaos4.13.el8, 3:4.4.1-5.2.rhaos4.13.el8, 4:1.1.12-1.1.rhaos4.13.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 0:0.19.0-1.3.rhaos4.14.el8, 0:0.19.0-1.4.rhaos4.14.el8, 0:1.27.0-3.1.el8, 0:1.27.0-3.2.el8, 0:1.27.4-6.1.rhaos4.14.gitd09e4c0.el8, 0:1.27.4-7.2.rhaos4.14.git082c52f.el8, 0:2.16.2-2.1.rhaos4.14.el9, 0:2.16.2-2.2.rhaos4.14.el9, 0:4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8, 0:4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8, 0:4.14.0-202404151639.p0.g81558cc.assembly.stream.el8, 0:4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8, 0:4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el8, 0:4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8, 1:1.4.0-1.2.rhaos4.14.el8, 1:1.4.0-1.3.rhaos4.14.el8, 1:1.29.1-10.4.rhaos4.14.el8, 2:1.11.2-10.3.rhaos4.14.el8, 3:2.1.7-3.4.rhaos4.14.el8, 3:4.4.1-11.3.rhaos4.14.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 0:0.20.0-1.1.rhaos4.15.el8, 0:1.28.0-3.1.el8, 0:1.28.4-8.rhaos4.15.git24f50b9.el8, 0:2.16.2-2.1.rhaos4.15.el9, 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8, 0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8, 0:4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9, 1:1.4.0-1.2.rhaos4.15.el8, 1:1.29.1-20.3.rhaos4.15.el8, 2:1.11.2-21.2.rhaos4.15.el8, 3:4.4.1-21.1.rhaos4.15.el8, 4:1.1.12-1.1.rhaos4.15.el8, 415.92.202407191425-0
  • Red Hat Red Hat OpenStack Platform 16.2 0:3.3.23-16.el8ost
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8 0:0.2.1-3.el8ost
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 0:0.2.1-3.el9ost, 0:3.4.26-8.el9ost
  • Red Hat RHODF-4.16-RHEL-9 v4.16.0-38, v4.16.0-137
  • osbuild-composer RHEL 9 132-1.el9
  • osbuild-composer-core RHEL 9 132-1.el9
  • osbuild-composer-worker RHEL 9 132-1.el9
  • crit RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65
  • criu RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65
  • crun RHEL 8 1.14.3-2.module+el8.10.0+22202+761b9a65
  • runc RHEL 8 1:1.1.12-4.module+el8.10.0+22202+761b9a65
  • udica RHEL 8 0.2.6-21.module+el8.10.0+22202+761b9a65

red hat advisories RHSA-2025:7118RHSA-2024:5258RHSA-2024:1472RHSA-2024:2562RHSA-2024:1567RHSA-2024:1574

  • osbuild AlmaLinux 9 141-1.el9.alma.1
  • osbuild-composer AlmaLinux 9 132-1.el9.alma.1
  • osbuild-lvm2 AlmaLinux 9 141-1.el9.alma.1
  • osbuild-luks2 AlmaLinux 9 141-1.el9.alma.1
  • osbuild-ostree AlmaLinux 9 141-1.el9.alma.1
  • osbuild-selinux AlmaLinux 9 141-1.el9.alma.1
  • python3-osbuild AlmaLinux 9 141-1.el9.alma.1
  • osbuild-depsolve-dnf AlmaLinux 9 141-1.el9.alma.1

almalinux advisories ALSA-2025:7118ALSA-2024:7262ALSA-2024:5258ALSA-2024:4761ALSA-2024:4762ALSA-2024:4502

  • osbuild-composer Rocky Linux 8 101-2.el8_10.rocky.0.6
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-4.module+el8.10.0+1843+6892ab28
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-12.module+el8.10.0+1843+6892ab28
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:7262RLSA-2024:5258RLSA-2024:4502RLSA-2024:3265RLSA-2024:1502RLSA-2024:2562

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-1394 updated cvss 7.5

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

  • Red Hat NBDE Tang Server tang-operator-bundle-container
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-clients
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 1.2 helm, openshift-clients
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 podman, skopeo, buildah, host-metering, rhc-worker-script, host-metering-selinux, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 butane, ignition, ignition-edge, ignition-grub, ignition-validate
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/bare-metal-event-relay-operator-bundle Red Hat Openshift Container Storage 4 mcg
    affected: workaround, no fix planned “Out of support scope”
show 21 more
  • Red Hat OpenShift Dev Spaces devspaces/machineexec-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/gitops-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift on AWS rosa
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 16.1 etcd, golang-qpid-apache
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 golang-qpid-apache, golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.1 golang-qpid-apache Red Hat OpenStack Platform 18.0 etcd
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Service Interconnect 1 qpid-proton, skupper-cli, skupper-router
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Storage 3 heketi, heketi-client, python-heketi
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.5-1.el8ap, receptorctl 1.4.5-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.5-1.el9ap, receptorctl 1.4.5-1.el9ap
    fixed: vendor fix RHSA-2024:1640
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang 1.19.13-6.el7_9, go-toolset-1.19-golang-bin 1.19.13-6.el7_9, go-toolset-1.19-golang-src 1.19.13-6.el7_9, go-toolset-1.19-golang-misc 1.19.13-6.el7_9, go-toolset-1.19-golang-race 1.19.13-6.el7_9, go-toolset-1.19-golang-tests 1.19.13-6.el7_9 Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang 1.19.13-6.el7_9, go-toolset-1.19-golang-bin 1.19.13-6.el7_9, go-toolset-1.19-golang-src 1.19.13-6.el7_9, go-toolset-1.19-golang-misc 1.19.13-6.el7_9, go-toolset-1.19-golang-race 1.19.13-6.el7_9, go-toolset-1.19-golang-tests 1.19.13-6.el7_9
    fixed: vendor fix RHSA-2024:1468
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-8.el8_9, grafana 9.2.10-16.el8_10, grafana-pcp 5.1.1-2.el8_9, osbuild-composer 101-2.el8_10, grafana-selinux 9.2.10-16.el8_10, osbuild-composer-core 101-2.el8_10, +41 more
    fixed: vendor fix RHSA-2024:5258
  • Red Hat Enterprise Linux AppStream (v. 9) runc 1.1.12-3.el9_4, podman 4.9.4-5.el9_4, golang 1.21.9-2.el9_4, skopeo 1.14.3-3.el9_4, buildah 1.33.7-3.el9_4, golang 1.20.12-2.el9_3, +26 more
    fixed: vendor fix RHSA-2024:1462
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) podman 4.2.0-4.el9_0, podman-tests 4.2.0-4.el9_0, podman-docker 4.2.0-4.el9_0, podman-remote 4.2.0-4.el9_0, podman-gvproxy 4.2.0-4.el9_0, podman-plugins 4.2.0-4.el9_0, +2 more
    fixed: vendor fix RHSA-2024:4672
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman 4.4.1-20.el9_2, golang 1.19.13-7.el9_2, golang-bin 1.19.13-7.el9_2, golang-src 1.19.13-7.el9_2, golang-misc 1.19.13-7.el9_2, golang-race 1.19.13-7.el9_2, +6 more
    fixed: vendor fix RHSA-2024:4146
  • Red Hat OpenShift Container Platform 4.12 cri-tools 1.25.0-2.2.el8, cri-tools 1.25.0-2.2.el9, runc 1.1.6-5.2.rhaos4.12.el8, podman 4.2.0-7.2.rhaos4.12.el9, podman 4.4.1-2.1.rhaos4.12.el8, skopeo 1.9.4-3.2.rhaos4.12.el8, +32 more
    fixed: vendor fix RHSA-2024:1574
  • Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-4.1.el8, cri-tools 1.26.0-4.2.el9, runc 1.1.12-1.1.rhaos4.13.el8, runc 1.1.12-1.1.rhaos4.13.el9, podman 4.4.1-5.2.rhaos4.13.el8, podman 4.4.1-6.2.rhaos4.13.el9, +28 more
    fixed: vendor fix RHSA-2024:1763
  • Red Hat OpenShift Container Platform 4.14 cri-tools 1.27.0-3.1.el8, cri-tools 1.27.0-3.1.el9, cri-tools 1.27.0-3.2.el8, cri-tools 1.27.0-3.2.el9, rhcos 414.92.202407300859-0, runc 1.1.12-1.2.rhaos4.14.el8, +86 more
    fixed: vendor fix RHSA-2024:1897
  • Red Hat OpenShift Container Platform 4.15 cri-tools 1.28.0-3.1.el8, cri-tools 1.28.0-3.1.el9, rhcos 415.92.202407191425-0, runc 1.1.12-1.1.rhaos4.15.el8, runc 1.1.12-1.1.rhaos4.15.el9, butane 0.20.0-1.1.rhaos4.15.el8, +40 more
    fixed: vendor fix RHSA-2024:1563
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-16.el8ost
    fixed: vendor fix RHSA-2024:3352
  • Red Hat OpenStack Platform 17.1 etcd 3.4.26-8.el9ost, collectd-sensubility 0.2.1-3.el8ost, collectd-sensubility 0.2.1-3.el9ost
    fixed: vendor fix RHSA-2024:2767
  • Red Hat RHODF 4.16 for RHEL 9 odf4/mcg-rhel9-operator v4.16.0-38, odf4/mcg-operator-bundle v4.16.0-137
    fixed: vendor fix RHSA-2024:4591
  • Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core 2.15.10-1.el8ap, ansible-runner 2.3.6-1.el8ap, ansible-test 2.15.10-1.el8ap, python39-aiohttp 3.9.3-1.el8ap, python39-django 4.2.11-1.el8ap, python3x-aiohttp 3.9.3-1.el8ap, +9 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core 2.15.10-1.el9ap, ansible-runner 2.3.6-1.el9ap, ansible-test 2.15.10-1.el9ap, python-aiohttp 3.9.3-1.el9ap, python-django 4.2.11-1.el9ap, python3-aiohttp 3.9.3-1.el9ap, +9 more Red Hat Enterprise Linux 8 rhc, runc, conmon, podman, skopeo, buildah, +15 more Red Hat Enterprise Linux 9 conmon, git-lfs, toolbox, weldr-client, toolbox-tests Red Hat Enterprise Linux AppStream (v. 9) osbuild 141-1.el9, osbuild-lvm2 141-1.el9, osbuild-luks2 141-1.el9, osbuild-ostree 141-1.el9, osbuild-selinux 141-1.el9, python3-osbuild 141-1.el9, +1 more
    not affected: vulnerable code not present

11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/golang-fips/go
<=1.22.1
 no fix listed
go github.com/golang-fips/openssl/v2
<2.0.1
2.0.1
go github.com/microsoft/go-crypto-openssl
<=0.2.8
<0.2.9
0.2.9
go github.com/microsoft/go-crypto-openssl/openssl
<0.2.9
0.2.9

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Red Hat Developer Tools
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9
  • Red Hat RHODF-4.16-RHEL-9
  • Red Hat NBDE Tang Server
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat Ansible Automation Platform 1.2
  • Red Hat Red Hat Certification for Red Hat Enterprise Linux 8
  • Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Openshift Container Storage 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift on AWS
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.1
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Red Hat Service Interconnect 1
  • Red Hat Red Hat Software Collections
  • Red Hat Red Hat Storage 3

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.