VDB
KO
HIGH 7.5

GHSA-78hx-gp6g-7mj6

Memory leaks in code encrypting and verifying RSA payloads

Quick fix

GHSA-78hx-gp6g-7mj6 — github.com/golang-fips/openssl/v2: upgrade to the fixed version with the command below. 

go get github.com/golang-fips/openssl/v2@v2.0.1

Details

Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads.

An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/golang-fips/go
Introduced in: 0

No fixed version published yet for github.com/golang-fips/go (go modules). Pin to a known-safe version or switch to an alternative.

Go / github.com/golang-fips/openssl/v2
Introduced in: 0 Fixed in: 2.0.1
Fix go get github.com/golang-fips/openssl/v2@v2.0.1
Go / github.com/microsoft/go-crypto-openssl
Introduced in: 0

No fixed version published yet for github.com/microsoft/go-crypto-openssl (go modules). Pin to a known-safe version or switch to an alternative.

Go / github.com/microsoft/go-crypto-openssl/openssl
Introduced in: 0 Fixed in: 0.2.9
Fix go get github.com/microsoft/go-crypto-openssl/openssl@v0.2.9

References