{"answers":{"affected":"10 open source packages ship an affected version, including github.com/golang-fips/openssl/v2, github.com/golang-fips/go and github.com/microsoft/go-crypto-openssl.","exploited":"There is no known exploitation of CVE-2024-1394 in the wild and no public exploit code.","fix":"Upgrade github.com/golang-fips/openssl/v2 to 2.0.1 or later.","what":"CVE-2024-1394 is a high-severity denial of service vulnerability in Red Hat NBDE Tang Server, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-1394 and fix it if it is affected.\n\nWhat it is: CVE-2024-1394 is a high-severity denial of service vulnerability in Red Hat NBDE Tang Server, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-1394 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/golang-fips/openssl/v2 (Go): affected all versions; fixed in 2.0.1\n- github.com/golang-fips/openssl/v2 (Go): affected all versions; fixed in 2.0.1\n- github.com/golang-fips/openssl/v2 (Go): affected all versions; fixed in 2.0.1\n- github.com/golang-fips/go (Go): affected all versions up to 1.22.1; no fix listed\n- github.com/golang-fips/go (Go): affected all versions up to 1.22.1; no fix listed\n- github.com/microsoft/go-crypto-openssl (Go): affected all versions up to 0.2.8; no fix listed\n- github.com/microsoft/go-crypto-openssl (Go): affected all versions up to 0.2.8; no fix listed\n- github.com/microsoft/go-crypto-openssl (Go): affected all versions; fixed in 0.2.9\n- github.com/microsoft/go-crypto-openssl/openssl (Go): affected all versions; fixed in 0.2.9\n- github.com/microsoft/go-crypto-openssl/openssl (Go): affected all versions; fixed in 0.2.9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-1394/ (Markdown: https://insights.sbomify.com/CVE-2024-1394/index.md)","id":"CVE-2024-1394","markdown":"https://insights.sbomify.com/CVE-2024-1394/index.md","name":"CVE-2024-1394","record":{"aliases":["ALSA-2024:1462","ALSA-2024:1472","ALSA-2024:1501","ALSA-2024:1502","ALSA-2024:1644","ALSA-2024:1646","ALSA-2024:2569","ALSA-2024:4371","ALSA-2024:4378","ALSA-2024:4379","ALSA-2024:4502","ALSA-2024:4761","ALSA-2024:4762","AZL-110327","AZL-110382","AZL-110516","AZL-110519","GHSA-78hx-gp6g-7mj6","GO-2024-2660","RHSA-2024:1462","RHSA-2024:1468","RHSA-2024:1472","RHSA-2024:1501","RHSA-2024:1502","RHSA-2024:1561","RHSA-2024:1566","RHSA-2024:1644","RHSA-2024:1646","RHSA-2024:1763","RHSA-2024:2569","RHSA-2024:4371","RHSA-2024:4378","RHSA-2024:4379","RHSA-2024:4502","RHSA-2024:4581","RHSA-2024:4672","RHSA-2024:4761","RHSA-2024:4762","RLSA-2024:1472","RLSA-2024:1502","RLSA-2024:1644","RLSA-2024:1646","RLSA-2024:2569","RLSA-2024:4502"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Go FIPS OpenSSL library","requires_auth":"none","summary":"A memory leak in the Go FIPS OpenSSL library allows attackers to cause resource exhaustion and denial of service via crafted RSA payloads.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the \"return nil, nil, fail(...)\" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.","ecosystems":["AlmaLinux:8","AlmaLinux:9","Go","Red Hat:devtools:2023::el7","Red Hat:enterprise_linux:8::appstream","Red Hat:enterprise_linux:9::appstream","Red Hat:openshift:4.13::el8","Red Hat:openshift:4.13::el9","Red Hat:openshift:4.14::el9","Red Hat:openshift:4.15::el9","Red Hat:rhel_e4s:9.0::appstream","Rocky Linux:8","Rocky Linux:9"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads","id":"CVE-2024-1394","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":214,"n_references":46,"next":{"headline":"Mali GPU Kernel Driver allows improper GPU memory processing operations","id":"CVE-2024-1395"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.22.1"],"package":"github.com/golang-fips/go","purl":null,"source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.22.1"],"package":"github.com/golang-fips/go","purl":"pkg:golang/github.com/golang-fips/go","source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":["2.0.1"],"introduced":["0"],"last_affected":[],"package":"github.com/golang-fips/openssl/v2","purl":null,"source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":["2.0.1"],"introduced":["0"],"last_affected":[],"package":"github.com/golang-fips/openssl/v2","purl":"pkg:golang/github.com/golang-fips/openssl/v2","source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":["2.0.1"],"introduced":["0"],"last_affected":[],"package":"github.com/golang-fips/openssl/v2","purl":"pkg:golang/github.com/golang-fips/openssl/v2","source":"GO-2024-2660"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["0.2.8"],"package":"github.com/microsoft/go-crypto-openssl","purl":null,"source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["0.2.8"],"package":"github.com/microsoft/go-crypto-openssl","purl":"pkg:golang/github.com/microsoft/go-crypto-openssl","source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":["0.2.9"],"introduced":["0"],"last_affected":[],"package":"github.com/microsoft/go-crypto-openssl","purl":"pkg:golang/github.com/microsoft/go-crypto-openssl","source":"GO-2024-2660"},{"ecosystem":"Go","fixed":["0.2.9"],"introduced":["0"],"last_affected":[],"package":"github.com/microsoft/go-crypto-openssl/openssl","purl":null,"source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"Go","fixed":["0.2.9"],"introduced":["0"],"last_affected":[],"package":"github.com/microsoft/go-crypto-openssl/openssl","purl":"pkg:golang/github.com/microsoft/go-crypto-openssl/openssl","source":"GHSA-78hx-gp6g-7mj6"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.2-1.module_el8.9.0+3642+43318da8"],"introduced":["0"],"last_affected":[],"package":"delve","purl":"pkg:rpm/almalinux/delve","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-1.module_el8.9.0+3728+f1d47c6f"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/almalinux/go-toolset","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/almalinux/golang","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang-bin","purl":"pkg:rpm/almalinux/golang-bin","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang-docs","purl":"pkg:rpm/almalinux/golang-docs","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang-misc","purl":"pkg:rpm/almalinux/golang-misc","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang-src","purl":"pkg:rpm/almalinux/golang-src","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["1.20.12-3.module_el8.9.0+3750+10f4110d"],"introduced":["0"],"last_affected":[],"package":"golang-tests","purl":"pkg:rpm/almalinux/golang-tests","source":"ALSA-2024:1472"},{"ecosystem":"AlmaLinux:8","fixed":["9.2.10-8.el8_9.alma.1"],"introduced":["0"],"last_affected":[],"package":"grafana","purl":"pkg:rpm/almalinux/grafana","source":"ALSA-2024:1646"},{"ecosystem":"AlmaLinux:8","fixed":["5.1.1-2.el8_9.alma.1"],"introduced":["0"],"last_affected":[],"package":"grafana-pcp","purl":"pkg:rpm/almalinux/grafana-pcp","source":"ALSA-2024:1644"},{"ecosystem":"AlmaLinux:9","fixed":["2:1.33.7-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"buildah","purl":"pkg:rpm/almalinux/buildah","source":"ALSA-2024:4371"},{"ecosystem":"AlmaLinux:9","fixed":["2:1.33.7-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"buildah-tests","purl":"pkg:rpm/almalinux/buildah-tests","source":"ALSA-2024:4371"},{"ecosystem":"AlmaLinux:9","fixed":["1:1.4.0-4.el9_4"],"introduced":["0"],"last_affected":[],"package":"containernetworking-plugins","purl":"pkg:rpm/almalinux/containernetworking-plugins","source":"ALSA-2024:4761"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/almalinux/go-toolset","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/almalinux/golang","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang-bin","purl":"pkg:rpm/almalinux/golang-bin","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang-docs","purl":"pkg:rpm/almalinux/golang-docs","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang-misc","purl":"pkg:rpm/almalinux/golang-misc","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang-src","purl":"pkg:rpm/almalinux/golang-src","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["1.20.12-2.el9_3"],"introduced":["0"],"last_affected":[],"package":"golang-tests","purl":"pkg:rpm/almalinux/golang-tests","source":"ALSA-2024:1462"},{"ecosystem":"AlmaLinux:9","fixed":["9.2.10-8.el9_3.alma.1"],"introduced":["0"],"last_affected":[],"package":"grafana","purl":"pkg:rpm/almalinux/grafana","source":"ALSA-2024:1501"},{"ecosystem":"AlmaLinux:9","fixed":["5.1.1-2.el9_3.alma.1"],"introduced":["0"],"last_affected":[],"package":"grafana-pcp","purl":"pkg:rpm/almalinux/grafana-pcp","source":"ALSA-2024:1502"},{"ecosystem":"AlmaLinux:9","fixed":["5.1.1-2.el9_4.alma.1"],"introduced":["0"],"last_affected":[],"package":"grafana-pcp","purl":"pkg:rpm/almalinux/grafana-pcp","source":"ALSA-2024:2569"},{"ecosystem":"AlmaLinux:9","fixed":["6:0.7.3-4.el9_4.alma.1"],"introduced":["0"],"last_affected":[],"package":"gvisor-tap-vsock","purl":"pkg:rpm/almalinux/gvisor-tap-vsock","source":"ALSA-2024:4379"},{"ecosystem":"AlmaLinux:9","fixed":["4:4.9.4-5.el9_4"],"introduced":["0"],"last_affected":[],"package":"podman","purl":"pkg:rpm/almalinux/podman","source":"ALSA-2024:4378"},{"ecosystem":"AlmaLinux:9","fixed":["4:4.9.4-5.el9_4"],"introduced":["0"],"last_affected":[],"package":"podman-docker","purl":"pkg:rpm/almalinux/podman-docker","source":"ALSA-2024:4378"},{"ecosystem":"AlmaLinux:9","fixed":["4:4.9.4-5.el9_4"],"introduced":["0"],"last_affected":[],"package":"podman-plugins","purl":"pkg:rpm/almalinux/podman-plugins","source":"ALSA-2024:4378"},{"ecosystem":"AlmaLinux:9","fixed":["4:4.9.4-5.el9_4"],"introduced":["0"],"last_affected":[],"package":"podman-remote","purl":"pkg:rpm/almalinux/podman-remote","source":"ALSA-2024:4378"},{"ecosystem":"AlmaLinux:9","fixed":["4:4.9.4-5.el9_4"],"introduced":["0"],"last_affected":[],"package":"podman-tests","purl":"pkg:rpm/almalinux/podman-tests","source":"ALSA-2024:4378"},{"ecosystem":"AlmaLinux:9","fixed":["4:1.1.12-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/almalinux/runc","source":"ALSA-2024:4762"}],"prev":{"headline":"Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements)","id":"CVE-2024-1393"},"products":["NBDE Tang Server","OpenShift Developer Tools and Services","OpenShift Pipelines","OpenShift Serverless","RHODF-4.16-RHEL-9","Red Hat Ansible Automation Platform 1.2","Red Hat Ansible Automation Platform 2.4 for RHEL 8","Red Hat Ansible Automation Platform 2.4 for RHEL 9","Red Hat Certification Program for Red Hat Enterprise Linux 9","Red Hat Certification for Red Hat Enterprise Linux 8","Red Hat Developer Tools","Red Hat Enterprise Linux 7","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 9","Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat OpenShift Container Platform 4","Red Hat OpenShift Container Platform 4.12","Red Hat OpenShift Container Platform 4.13","Red Hat OpenShift Container Platform 4.14","Red Hat OpenShift Container Platform 4.15","Red Hat OpenShift Dev Spaces","Red Hat OpenShift GitOps","Red Hat OpenShift Virtualization 4","Red Hat OpenShift on AWS","Red Hat OpenStack Platform 16.1","Red Hat OpenStack Platform 16.2","Red Hat OpenStack Platform 17.1","Red Hat OpenStack Platform 17.1 for RHEL 8","Red Hat OpenStack Platform 17.1 for RHEL 9","Red Hat OpenStack Platform 18.0","Red Hat Openshift Container Storage 4","Red Hat Service Interconnect 1","Red Hat Software Collections","Red Hat Storage 3"],"published":"2024-03-21","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-29","vendors":["Red Hat"]},"summary":"A memory leak in the Go FIPS OpenSSL library allows attackers to cause resource exhaustion and denial of service via crafted RSA payloads.","url":"https://insights.sbomify.com/CVE-2024-1394/"}