{"schema_version":"1.3.1","id":"GO-2024-2660","modified":"2024-05-20T16:03:47Z","published":"2024-03-27T22:08:48Z","aliases":["CVE-2024-1394","GHSA-78hx-gp6g-7mj6"],"summary":"Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl","details":"Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack.","affected":[{"package":{"name":"github.com/golang-fips/openssl/v2","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/golang-fips/openssl/v2","symbols":["DecryptRSANoPadding","DecryptRSAOAEP","DecryptRSAPKCS1","EncryptRSANoPadding","EncryptRSAOAEP","EncryptRSAPKCS1","NewGCMTLS","NewGCMTLS13","NewRC4Cipher","SignMarshalECDSA","SignRSAPKCS1v15","SignRSAPSS","VerifyECDSA","VerifyRSAPKCS1v15","VerifyRSAPSS","aesCipher.Decrypt","aesCipher.Encrypt","aesCipher.NewCBCDecrypter","aesCipher.NewCBCEncrypter","aesCipher.NewCTR","aesCipher.NewGCM","aesCipher.NewGCMTLS","aesCipher.NewGCMTLS13","desCipher.Decrypt","desCipher.Encrypt","desCipher.NewCBCDecrypter","desCipher.NewCBCEncrypter","desCipherWithoutCBC.Decrypt","desCipherWithoutCBC.Encrypt","newCipherCtx","noGCM.Decrypt","noGCM.Encrypt","setupEVP"]}]}},{"package":{"name":"github.com/microsoft/go-crypto-openssl","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.9"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/microsoft/go-crypto-openssl/openssl","symbols":["DecryptRSANoPadding","DecryptRSAOAEP","DecryptRSAOAEPWithMGF1Hash","DecryptRSAPKCS1","EncryptRSANoPadding","EncryptRSAOAEP","EncryptRSAOAEPWithMGF1Hash","EncryptRSAPKCS1","SignMarshalECDSA","SignRSAPKCS1v15","SignRSAPSS","VerifyECDSA","VerifyRSAPKCS1v15","VerifyRSAPSS","setupEVP"]}]}}],"references":[{"type":"FIX","url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136"},{"type":"FIX","url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f"}],"credits":[{"name":"@qmuntal and @r3kumar"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-2660","review_status":"REVIEWED"}}