CVE-2024-1394
highpriority · track · 1EPSS 0.015 · 75 %ileDEEURUUSEPSS · scored 2026-10-22
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (145)
Products and version ranges known to be affected.
- Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
- Red Hat Ansible Automation Platform 2.4all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.4
- Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
- Red Hat OpenShift CodeReady Workspacesall versionscert_bundDEcpe:/a:redhat:openshift:codeready_workspaces
- Red Hat OpenShift Container Platform 4.14all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.14.4
- Red Hat OpenShift Container Platform 4.15all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.15
- Red Hat OpenShift Custom Metric Autoscaler 2all versionscert_bundDEcpe:/a:redhat:openshift:custom_metric_autoscaler_2
- Red Hat OpenShift Developer Tools and Servicesall versionscert_bundDEcpe:/a:redhat:openshift:developer_tools_and_services
advisories (7)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-0681Red Hat Enterprise Linux: Golang-Komponenten-Schwachstelle ermöglicht Denial of ServiceDeutsch2024-03-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift, Red Hat Ansible Automation Platform und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-1226Red Hat OpenShift: Mehrere SchwachstellenDeutsch2024-05-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.
- WID-SEC-W-2024-1228Red Hat OpenStack: Mehrere SchwachstellenDeutsch2024-05-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um Sicherheitsmaßnahmen zu umgehen, eine Denial-of-Service-Zustand zu erzeugen, um vertrauliche Informationen offenzulegen und Daten zu ändern.
- WID-SEC-W-2024-1307Red Hat OpenShift Service Mesh Containers: Mehrere SchwachstellenDeutsch2024-06-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh Containers ausnutzen, um Dateien zu manipulieren, einen 'Denial of Service'-Zustand erzuegen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
- GHSA-78hx-gp6g-7mj6Memory leaks in code encrypting and verifying RSA payloads2024-03-20ghsa · osvUS
Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
- GO-2024-2660Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl2024-03-27vendor · osvUS
Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (101)
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2024:1462cnnvd
- https://access.redhat.com/errata/RHSA-2024:1468cnnvd
- https://access.redhat.com/errata/RHSA-2024:1472cnnvd
- https://access.redhat.com/security/cve/CVE-2024-1394cnnvd
- https://access.redhat.com/security/cve/cve-2024-1394cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2262921cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-1394/cnnvd
- https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan