1. Home
  2. Security Advisories
  3. Go
  4. GO-2024-2660

[GO-2024-2660] Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Using crafted public RSA keys can cause a small memory leak when encrypting and
verifying payloads. This can be gradually leveraged into a denial of service
attack.

Package Affected Version
pkg:golang/github.com/microsoft/go-crypto-openssl/openssl >= 0.2.8, < 0.2.9
pkg:golang/github.com/golang-fips/openssl/v2 >= 2.0.0, < 2.0.1
Package Fixed Version
pkg:golang/github.com/microsoft/go-crypto-openssl/openssl = 0.2.9
pkg:golang/github.com/golang-fips/openssl/v2 = 2.0.1
ID
GO-2024-2660
Severity
high
Severity from
CVE-2024-1394
URL
https://pkg.go.dev/vuln/GO-2024-2660
Published
2024-03-21T20:13:40
(6 months ago)
Modified
2024-05-14T19:19:00
(4 months ago)
Other Advisories
Source # ID Name URL
Security Advisory https://github.com/advisories/GHSA-78hx-gp6g-7mj6
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/github.com/microsoft/go-crypto-openssl/openssl github.com/microsoft/go-crypto-openssl openssl = 0.2.9
Affected pkg:golang/github.com/microsoft/go-crypto-openssl/openssl github.com/microsoft/go-crypto-openssl openssl >= 0.2.8 < 0.2.9
Fixed pkg:golang/github.com/golang-fips/openssl/v2 github.com/golang-fips/openssl v2 = 2.0.1
Affected pkg:golang/github.com/golang-fips/openssl/v2 github.com/golang-fips/openssl v2 >= 2.0.0 < 2.0.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date