GO-2024-2660

Source
https://pkg.go.dev/vuln/GO-2024-2660
Import Source
https://vuln.go.dev/ID/GO-2024-2660.json
Aliases
Published
2024-03-27T22:08:48Z
Modified
2024-03-27T22:41:27.024401Z
Details

Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack.

References

Affected packages

Go / github.com/golang-fips/openssl/v2

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.0.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/golang-fips/openssl/v2",
            "symbols": [
                "DecryptRSANoPadding",
                "DecryptRSAOAEP",
                "DecryptRSAPKCS1",
                "EncryptRSANoPadding",
                "EncryptRSAOAEP",
                "EncryptRSAPKCS1",
                "NewGCMTLS",
                "NewGCMTLS13",
                "NewRC4Cipher",
                "SignMarshalECDSA",
                "SignRSAPKCS1v15",
                "SignRSAPSS",
                "VerifyECDSA",
                "VerifyRSAPKCS1v15",
                "VerifyRSAPSS",
                "aesCipher.Decrypt",
                "aesCipher.Encrypt",
                "aesCipher.NewCBCDecrypter",
                "aesCipher.NewCBCEncrypter",
                "aesCipher.NewCTR",
                "aesCipher.NewGCM",
                "aesCipher.NewGCMTLS",
                "aesCipher.NewGCMTLS13",
                "desCipher.Decrypt",
                "desCipher.Encrypt",
                "desCipher.NewCBCDecrypter",
                "desCipher.NewCBCEncrypter",
                "desCipherWithoutCBC.Decrypt",
                "desCipherWithoutCBC.Encrypt",
                "newCipherCtx",
                "noGCM.Decrypt",
                "noGCM.Encrypt",
                "setupEVP"
            ]
        }
    ]
}

Go / github.com/microsoft/go-crypto-openssl

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.2.9

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/microsoft/go-crypto-openssl/openssl",
            "symbols": [
                "DecryptRSANoPadding",
                "DecryptRSAOAEP",
                "DecryptRSAOAEPWithMGF1Hash",
                "DecryptRSAPKCS1",
                "EncryptRSANoPadding",
                "EncryptRSAOAEP",
                "EncryptRSAOAEPWithMGF1Hash",
                "EncryptRSAPKCS1",
                "SignMarshalECDSA",
                "SignRSAPKCS1v15",
                "SignRSAPSS",
                "VerifyECDSA",
                "VerifyRSAPKCS1v15",
                "VerifyRSAPSS",
                "setupEVP"
            ]
        }
    ]
}