Skip to content

Commit 6432e7a

Browse files
timothy-kingtimothy-king
committed
data/reports: add GO-2024-2660.yaml
Aliases: CVE-2024-1394, GHSA-78hx-gp6g-7mj6 Fixes #2660 Change-Id: Ifed9ed6ce036a23df9bd1f853ec2ff891609b24a Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/573475 Run-TryBot: Tim King <[email protected]> TryBot-Result: Gopher Robot <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]>
1 parent 95de405 commit 6432e7a

File tree

2 files changed

+221
-0
lines changed

2 files changed

+221
-0
lines changed

‎data/osv/GO-2024-2660.json

+136
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2660",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-1394",
8+
"GHSA-78hx-gp6g-7mj6"
9+
],
10+
"summary": "Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl",
11+
"details": "Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/golang-fips/openssl/v2",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "2.0.1"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/golang-fips/openssl/v2",
35+
"symbols": [
36+
"DecryptRSANoPadding",
37+
"DecryptRSAOAEP",
38+
"DecryptRSAPKCS1",
39+
"EncryptRSANoPadding",
40+
"EncryptRSAOAEP",
41+
"EncryptRSAPKCS1",
42+
"NewGCMTLS",
43+
"NewGCMTLS13",
44+
"NewRC4Cipher",
45+
"SignMarshalECDSA",
46+
"SignRSAPKCS1v15",
47+
"SignRSAPSS",
48+
"VerifyECDSA",
49+
"VerifyRSAPKCS1v15",
50+
"VerifyRSAPSS",
51+
"aesCipher.Decrypt",
52+
"aesCipher.Encrypt",
53+
"aesCipher.NewCBCDecrypter",
54+
"aesCipher.NewCBCEncrypter",
55+
"aesCipher.NewCTR",
56+
"aesCipher.NewGCM",
57+
"aesCipher.NewGCMTLS",
58+
"aesCipher.NewGCMTLS13",
59+
"desCipher.Decrypt",
60+
"desCipher.Encrypt",
61+
"desCipher.NewCBCDecrypter",
62+
"desCipher.NewCBCEncrypter",
63+
"desCipherWithoutCBC.Decrypt",
64+
"desCipherWithoutCBC.Encrypt",
65+
"newCipherCtx",
66+
"noGCM.Decrypt",
67+
"noGCM.Encrypt",
68+
"setupEVP"
69+
]
70+
}
71+
]
72+
}
73+
},
74+
{
75+
"package": {
76+
"name": "github.com/microsoft/go-crypto-openssl",
77+
"ecosystem": "Go"
78+
},
79+
"ranges": [
80+
{
81+
"type": "SEMVER",
82+
"events": [
83+
{
84+
"introduced": "0"
85+
},
86+
{
87+
"fixed": "0.2.9"
88+
}
89+
]
90+
}
91+
],
92+
"ecosystem_specific": {
93+
"imports": [
94+
{
95+
"path": "github.com/microsoft/go-crypto-openssl/openssl",
96+
"symbols": [
97+
"DecryptRSANoPadding",
98+
"DecryptRSAOAEP",
99+
"DecryptRSAOAEPWithMGF1Hash",
100+
"DecryptRSAPKCS1",
101+
"EncryptRSANoPadding",
102+
"EncryptRSAOAEP",
103+
"EncryptRSAOAEPWithMGF1Hash",
104+
"EncryptRSAPKCS1",
105+
"SignMarshalECDSA",
106+
"SignRSAPKCS1v15",
107+
"SignRSAPSS",
108+
"VerifyECDSA",
109+
"VerifyRSAPKCS1v15",
110+
"VerifyRSAPSS",
111+
"setupEVP"
112+
]
113+
}
114+
]
115+
}
116+
}
117+
],
118+
"references": [
119+
{
120+
"type": "FIX",
121+
"url": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136"
122+
},
123+
{
124+
"type": "FIX",
125+
"url": "https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f"
126+
}
127+
],
128+
"credits": [
129+
{
130+
"name": "@qmuntal and @r3kumar"
131+
}
132+
],
133+
"database_specific": {
134+
"url": "https://pkg.go.dev/vuln/GO-2024-2660"
135+
}
136+
}

‎data/reports/GO-2024-2660.yaml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
id: GO-2024-2660
2+
modules:
3+
- module: github.com/golang-fips/openssl/v2
4+
versions:
5+
- fixed: 2.0.1
6+
vulnerable_at: 2.0.0
7+
packages:
8+
- package: github.com/golang-fips/openssl/v2
9+
symbols:
10+
- newCipherCtx
11+
- setupEVP
12+
derived_symbols:
13+
- DecryptRSANoPadding
14+
- DecryptRSAOAEP
15+
- DecryptRSAPKCS1
16+
- EncryptRSANoPadding
17+
- EncryptRSAOAEP
18+
- EncryptRSAPKCS1
19+
- NewGCMTLS
20+
- NewGCMTLS13
21+
- NewRC4Cipher
22+
- SignMarshalECDSA
23+
- SignRSAPKCS1v15
24+
- SignRSAPSS
25+
- VerifyECDSA
26+
- VerifyRSAPKCS1v15
27+
- VerifyRSAPSS
28+
- aesCipher.Decrypt
29+
- aesCipher.Encrypt
30+
- aesCipher.NewCBCDecrypter
31+
- aesCipher.NewCBCEncrypter
32+
- aesCipher.NewCTR
33+
- aesCipher.NewGCM
34+
- aesCipher.NewGCMTLS
35+
- aesCipher.NewGCMTLS13
36+
- desCipher.Decrypt
37+
- desCipher.Encrypt
38+
- desCipher.NewCBCDecrypter
39+
- desCipher.NewCBCEncrypter
40+
- desCipherWithoutCBC.Decrypt
41+
- desCipherWithoutCBC.Encrypt
42+
- noGCM.Decrypt
43+
- noGCM.Encrypt
44+
- module: github.com/microsoft/go-crypto-openssl
45+
versions:
46+
- fixed: 0.2.9
47+
vulnerable_at: 0.2.8
48+
packages:
49+
- package: github.com/microsoft/go-crypto-openssl/openssl
50+
symbols:
51+
- setupEVP
52+
derived_symbols:
53+
- DecryptRSANoPadding
54+
- DecryptRSAOAEP
55+
- DecryptRSAOAEPWithMGF1Hash
56+
- DecryptRSAPKCS1
57+
- EncryptRSANoPadding
58+
- EncryptRSAOAEP
59+
- EncryptRSAOAEPWithMGF1Hash
60+
- EncryptRSAPKCS1
61+
- SignMarshalECDSA
62+
- SignRSAPKCS1v15
63+
- SignRSAPSS
64+
- VerifyECDSA
65+
- VerifyRSAPKCS1v15
66+
- VerifyRSAPSS
67+
summary: |-
68+
Memory leak in github.com/golang-fips/openssl/v2 and
69+
github.com/microsoft/go-crypto-openssl
70+
description: |-
71+
Using crafted public RSA keys can cause a small memory leak when encrypting and
72+
verifying payloads. This can be gradually leveraged into a denial of service
73+
attack.
74+
cves:
75+
- CVE-2024-1394
76+
ghsas:
77+
- GHSA-78hx-gp6g-7mj6
78+
credits:
79+
- '@qmuntal and @r3kumar'
80+
references:
81+
- fix: https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
82+
- fix: https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
83+
notes:
84+
- github.com/golang-fips/go is patches to go standard compiler and library.
85+
- github.com/microsoft/go is a clone of the go standard compiler and library. This is outside of what vulncheck can handle.

0 commit comments

Comments
 (0)