Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 19 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.
Summary
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | 1.4.5-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | 1.4.5-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | 1.4.5-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | 1.4.5-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | 1.4.5-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | 1.4.5-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Developer Tools | — | 1.19.13-6.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8090020240313170136.26eb71ac | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 5.1.1-2.el8_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 9.2.10-8.el8_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 9.2.10-16.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020240808093819.afee755d | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 101-2.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.20.12-2.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 9.2.10-8.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 5.1.1-2.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.21.9-2.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 9.2.10-16.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 5.1.1-2.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:1.33.7-3.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 4:4.9.4-5.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 6:0.7.3-4.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:1.14.3-3.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1:1.4.0-4.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 4:1.1.12-3.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 132-1.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 2:4.2.0-4.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 1:1.0.1-6.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 1.19.13-7.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 2:4.4.1-20.el9_2 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1:1.23.4-5.2.rhaos4.12.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 0.16.0-2.2.rhaos4.12.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1:1.4.0-1.1.rhaos4.12.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1.25.3-5.2.rhaos4.12.git44a2cb2.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1.25.0-2.2.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 2.14.0-5.2.rhaos4.12.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 3:4.2.0-7.2.rhaos4.12.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 3:1.1.6-5.2.rhaos4.12.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 2:1.9.4-3.2.rhaos4.12.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1:1.29.1-2.2.rhaos4.13.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1:1.4.0-1.1.rhaos4.13.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1.26.5-11.1.rhaos4.13.git919cc6e.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1.26.0-4.1.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 2.15.0-7.1.rhaos4.13.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 4.13.0-202404020737.p0.gd192e90.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 3:4.4.1-5.2.rhaos4.13.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 4:1.1.12-1.1.rhaos4.13.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 2:1.11.2-2.2.rhaos4.13.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 0.19.0-1.3.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1:1.4.0-1.2.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.4-6.1.rhaos4.14.gitd09e4c0.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.0-3.1.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 2.16.2-2.1.rhaos4.14.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 3:4.4.1-11.3.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 2:1.11.2-10.3.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1:1.29.1-10.4.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 0.19.0-1.4.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 3:2.1.7-3.4.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1:1.4.0-1.3.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.4-7.2.rhaos4.14.git082c52f.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.0-3.2.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 2.16.2-2.2.rhaos4.14.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404151639.p0.g81558cc.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404151639.p0.g8926a29.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.0-202404151639.p0.g607e2dd.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 3:4.4.1-11.4.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4:1.1.12-1.2.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 2:1.11.2-10.4.rhaos4.14.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 414.92.202407300859-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1:1.29.1-20.3.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 0.20.0-1.1.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1:1.4.0-1.2.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1.28.4-8.rhaos4.15.git24f50b9.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1.28.0-3.1.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 2.16.2-2.1.rhaos4.15.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 3:4.4.1-21.1.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 4:1.1.12-1.1.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 2:1.11.2-21.2.rhaos4.15.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 415.92.202407191425-0 | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | 3.3.23-16.el8ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | — | 0.2.1-3.el8ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | 3.4.26-8.el9ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | 0.2.1-3.el9ost | Patch available | CNA |
| Red Hat | RHODF-4.16-RHEL-9 | — | v4.16.0-137 | Patch available | CNA |
| Red Hat | RHODF-4.16-RHEL-9 | — | v4.16.0-38 | Patch available | CNA |
| Red Hat | NBDE Tang Server | — | — | No fix listed | CNA |
| Red Hat | OpenShift Developer Tools and Services | — | — | No fix listed | CNA |
| Red Hat | OpenShift Developer Tools and Services | — | — | No fix listed | CNA |
| Red Hat | OpenShift Pipelines | — | — | Not affected | CNA |
| Red Hat | OpenShift Serverless | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 1.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 1.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Certification for Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat Openshift Container Storage 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Dev Spaces | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift GitOps | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift on AWS | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Service Interconnect 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Service Interconnect 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Service Interconnect 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Storage 3 | — | — | No fix listed | CNA |
| — | github.com/golang-fips/go (Go) | up to 1.22.1 | — | No fix listed | GHSA-78hx-gp6g-7mj6 |
| — | github.com/golang-fips/openssl/v2 (Go) | before 2.0.1 | 2.0.1 | Patch available | GHSA-78hx-gp6g-7mj6 |
| — | github.com/microsoft/go-crypto-openssl (Go) | up to 0.2.8 | — | No fix listed | GHSA-78hx-gp6g-7mj6 |
| — | github.com/microsoft/go-crypto-openssl/openssl (Go) | before 0.2.9 | 0.2.9 | Patch available | GHSA-78hx-gp6g-7mj6 |
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.4.5-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.4.5-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.4.5-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.4.5-1.el9ap Patch available CNA
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.4.5-1.el9ap Patch available CNA
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.4.5-1.el9ap Patch available CNA
- Red Hat Developer Tools VendorRed Hat Affected — Fixed in 1.19.13-6.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020240313170136.26eb71ac Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 5.1.1-2.el8_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 9.2.10-8.el8_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 9.2.10-16.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240808093819.afee755d Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 101-2.el8_10 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.20.12-2.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 9.2.10-8.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 5.1.1-2.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.21.9-2.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 9.2.10-16.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 5.1.1-2.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:1.33.7-3.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4:4.9.4-5.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 6:0.7.3-4.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:1.14.3-3.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1:1.4.0-4.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4:1.1.12-3.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 132-1.el9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:4.2.0-4.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1:1.0.1-6.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1.19.13-7.el9_2 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 2:4.4.1-20.el9_2 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1:1.23.4-5.2.rhaos4.12.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 0.16.0-2.2.rhaos4.12.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1:1.4.0-1.1.rhaos4.12.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1.25.3-5.2.rhaos4.12.git44a2cb2.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1.25.0-2.2.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 2.14.0-5.2.rhaos4.12.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 3:4.2.0-7.2.rhaos4.12.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 3:1.1.6-5.2.rhaos4.12.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 2:1.9.4-3.2.rhaos4.12.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1:1.29.1-2.2.rhaos4.13.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1:1.4.0-1.1.rhaos4.13.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1.26.5-11.1.rhaos4.13.git919cc6e.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1.26.0-4.1.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 2.15.0-7.1.rhaos4.13.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 4.13.0-202404020737.p0.gd192e90.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 3:4.4.1-5.2.rhaos4.13.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 4:1.1.12-1.1.rhaos4.13.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 2:1.11.2-2.2.rhaos4.13.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 0.19.0-1.3.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1:1.4.0-1.2.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.4-6.1.rhaos4.14.gitd09e4c0.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.0-3.1.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 2.16.2-2.1.rhaos4.14.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 3:4.4.1-11.3.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 2:1.11.2-10.3.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1:1.29.1-10.4.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 0.19.0-1.4.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 3:2.1.7-3.4.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1:1.4.0-1.3.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.4-7.2.rhaos4.14.git082c52f.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.0-3.2.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 2.16.2-2.2.rhaos4.14.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404151639.p0.g81558cc.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404151639.p0.g8926a29.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.0-202404151639.p0.g607e2dd.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 3:4.4.1-11.4.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4:1.1.12-1.2.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 2:1.11.2-10.4.rhaos4.14.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 414.92.202407300859-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1:1.29.1-20.3.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 0.20.0-1.1.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1:1.4.0-1.2.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1.28.4-8.rhaos4.15.git24f50b9.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1.28.0-3.1.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 2.16.2-2.1.rhaos4.15.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 3:4.4.1-21.1.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 4:1.1.12-1.1.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 2:1.11.2-21.2.rhaos4.15.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 415.92.202407191425-0 Patch available CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in 3.3.23-16.el8ost Patch available CNA
- Red Hat OpenStack Platform 17.1 for RHEL 8 VendorRed Hat Affected — Fixed in 0.2.1-3.el8ost Patch available CNA
- Red Hat OpenStack Platform 17.1 for RHEL 9 VendorRed Hat Affected — Fixed in 3.4.26-8.el9ost Patch available CNA
- Red Hat OpenStack Platform 17.1 for RHEL 9 VendorRed Hat Affected — Fixed in 0.2.1-3.el9ost Patch available CNA
- RHODF-4.16-RHEL-9 VendorRed Hat Affected — Fixed in v4.16.0-137 Patch available CNA
- RHODF-4.16-RHEL-9 VendorRed Hat Affected — Fixed in v4.16.0-38 Patch available CNA
- NBDE Tang Server VendorRed Hat Affected — Fixed in — No fix listed CNA
- OpenShift Developer Tools and Services VendorRed Hat Affected — Fixed in — No fix listed CNA
- OpenShift Developer Tools and Services VendorRed Hat Affected — Fixed in — No fix listed CNA
- OpenShift Pipelines VendorRed Hat Affected — Fixed in — Not affected CNA
- OpenShift Serverless VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 1.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 1.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Certification for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Certification Program for Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Openshift Container Storage 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Dev Spaces VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift GitOps VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift on AWS VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Virtualization 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Service Interconnect 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Service Interconnect 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Service Interconnect 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Storage 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- github.com/golang-fips/go (Go) Vendor— Affected up to 1.22.1 Fixed in — No fix listed GHSA-78hx-gp6g-7mj6
- github.com/golang-fips/openssl/v2 (Go) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-78hx-gp6g-7mj6
- github.com/microsoft/go-crypto-openssl (Go) Vendor— Affected up to 0.2.8 Fixed in — No fix listed GHSA-78hx-gp6g-7mj6
- github.com/microsoft/go-crypto-openssl/openssl (Go) Vendor— Affected before 0.2.9 Fixed in 0.2.9 Patch available GHSA-78hx-gp6g-7mj6
CPE names CNA · 46
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:ansible_automation_platform:2.4::el8 | 2.4 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform:2.4::el9 | 2.4 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8 | 2.4 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9 | 2.4 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8 | 2.4 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9 | 2.4 | — | Red Hat |
| cpe:/a:redhat:devtools:2023::el7 | 2023 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
- cpe:/a:redhat:ansible_automation_platform:2.4::el8 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform:2.4::el9 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9 Versions 2.4 — ·Red Hat
- cpe:/a:redhat:devtools:2023::el7 Versions 2023 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
Show 36 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:rhel_eus:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/a:redhat:openshift:4.12::el8 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.12::el9 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el8 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el8 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el8 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openstack:16.2::el8 | 16.2 | — | Red Hat |
| cpe:/a:redhat:openstack:17.1::el8 | 17.1 | — | Red Hat |
| cpe:/a:redhat:openstack:17.1::el9 | 17.1 | — | Red Hat |
| cpe:/a:redhat:openshift_data_foundation:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:network_bound_disk_encryption_tang:1 | 1 | — | Red Hat |
| cpe:/a:redhat:ocp_tools | — | — | Red Hat |
| cpe:/a:redhat:openshift_pipelines:1 | 1 | — | Red Hat |
| cpe:/a:redhat:serverless:1 | 1 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform | — | — | Red Hat |
| cpe:/a:redhat:certifications:1::el8 | 1 | — | Red Hat |
| cpe:/a:redhat:certifications:9 | 9 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9 | 9 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift_container_storage:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift_devspaces:3 | 3 | — | Red Hat |
| cpe:/a:redhat:openshift_gitops:1 | 1 | — | Red Hat |
| cpe:/a:redhat:openshift_service_on_aws:1 | 1 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openstack:16.1 | 16.1 | — | Red Hat |
| cpe:/a:redhat:openstack:16.2 | 16.2 | — | Red Hat |
| cpe:/a:redhat:openstack:17.1 | 17.1 | — | Red Hat |
| cpe:/a:redhat:openstack:18.0 | 18.0 | — | Red Hat |
| cpe:/a:redhat:service_interconnect:1 | 1 | — | Red Hat |
| cpe:/a:redhat:rhel_software_collections:3 | 3 | — | Red Hat |
| cpe:/a:redhat:storage:3 | 3 | — | Red Hat |
- cpe:/a:redhat:rhel_eus:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.12::el9 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el8 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el8 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el8 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openstack:16.2::el8 Versions 16.2 — ·Red Hat
- cpe:/a:redhat:openstack:17.1::el8 Versions 17.1 — ·Red Hat
- cpe:/a:redhat:openstack:17.1::el9 Versions 17.1 — ·Red Hat
- cpe:/a:redhat:openshift_data_foundation:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:network_bound_disk_encryption_tang:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:ocp_tools Versions — — ·Red Hat
- cpe:/a:redhat:openshift_pipelines:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:serverless:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform Versions — — ·Red Hat
- cpe:/a:redhat:certifications:1::el8 Versions 1 — ·Red Hat
- cpe:/a:redhat:certifications:9 Versions 9 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift_container_storage:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift_devspaces:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:openshift_gitops:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:openshift_service_on_aws:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openstack:16.1 Versions 16.1 — ·Red Hat
- cpe:/a:redhat:openstack:16.2 Versions 16.2 — ·Red Hat
- cpe:/a:redhat:openstack:17.1 Versions 17.1 — ·Red Hat
- cpe:/a:redhat:openstack:18.0 Versions 18.0 — ·Red Hat
- cpe:/a:redhat:service_interconnect:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:rhel_software_collections:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:storage:3 Versions 3 — ·Red Hat
Remediation
- Fix · GHSA-78hx-gp6g-7mj6 github.com/golang-fips/openssl/v2 (Go) Fixed in 2.0.1 Advisory →
- Fix · GHSA-78hx-gp6g-7mj6 github.com/microsoft/go-crypto-openssl/openssl (Go) Fixed in 0.2.9 Advisory →
Red Hat 39 advisories
- RHSA-2025:7118 Released 2025-05-13 · Red Hat rating Importantosbuild and osbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-132-1.el9, osbuild-composer-core-132-1.el9, osbuild-composer-worker-132-1.el9
- RHSA-2024:7262 Released 2024-09-26 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101-2.el8_10, osbuild-composer-core-101-2.el8_10, osbuild-composer-worker-101-2.el8_10
- RHSA-2024:5634 Released 2024-08-20 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) podman-2:4.4.1-20.el9_2, podman-docker-2:4.4.1-20.el9_2, podman-gvproxy-2:4.4.1-20.el9_2 +3
Show 36 more Red Hat advisories
- RHSA-2024:5258 Released 2024-08-13 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
- RHSA-2024:4960 Released 2024-08-07 · Red Hat rating ImportantOpenShift Container Platform 4.14.34 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8 +6
- RHSA-2024:4699 Released 2024-07-25 · Red Hat rating ImportantOpenShift Container Platform 4.15.23 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-cloud-credential-operator, openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8, openshift4/ose-ibm-vpc-block-csi-driver-rhel9 +4
- RHSA-2024:4762 Released 2024-07-23 · Red Hat rating Importantrunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.12-3.el9_4
- RHSA-2024:4761 Released 2024-07-23 · Red Hat rating Importantcontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-4.el9_4
- RHSA-2024:4672 Released 2024-07-22 · Red Hat rating Importantcontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) containernetworking-plugins-1:1.0.1-6.el9_0
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
- RHSA-2024:4581 Released 2024-07-16 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) podman-2:4.2.0-4.el9_0, podman-catatonit-2:4.2.0-4.el9_0, podman-docker-2:4.2.0-4.el9_0 +4
- RHSA-2024:4502 Released 2024-07-15 · Red Hat rating Importantskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.14.3-3.el9_4, skopeo-tests-2:1.14.3-3.el9_4
- RHSA-2024:4379 Released 2024-07-08 · Red Hat rating Importantgvisor-tap-vsock security update
- Red Hat Enterprise Linux AppStream (v. 9) gvisor-tap-vsock-6:0.7.3-4.el9_4
- RHSA-2024:4378 Released 2024-07-08 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-5.el9_4, podman-docker-4:4.9.4-5.el9_4, podman-plugins-4:4.9.4-5.el9_4 +2
- RHSA-2024:4371 Released 2024-07-08 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.7-3.el9_4, buildah-tests-2:1.33.7-3.el9_4
- RHSA-2024:4146 Released 2024-06-27 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) golang-1.19.13-7.el9_2, golang-bin-1.19.13-7.el9_2, golang-docs-1.19.13-7.el9_2 +4
- RHSA-2024:3352 Released 2024-05-23 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-16.el8ost
- RHSA-2024:2730 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el9ost
- RHSA-2024:2729 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (etcd) security update
- Red Hat OpenStack Platform 17.1 etcd-3.4.26-8.el9ost
- RHSA-2024:2767 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el8ost
- RHSA-2024:3265 Released 2024-05-22 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-16.el8_10, grafana-selinux-9.2.10-16.el8_10
- RHSA-2024:2562 Released 2024-04-30 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.9-2.el9_4, golang-1.21.9-2.el9_4, golang-bin-1.21.9-2.el9_4 +4
- RHSA-2024:2568 Released 2024-04-30 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-16.el9_4, grafana-selinux-9.2.10-16.el9_4
- RHSA-2024:2569 Released 2024-04-30 · Red Hat rating Importantgrafana-pcp security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-2.el9_4
- RHSA-2024:1897 Released 2024-04-26 · Red Hat rating ImportantOpenShift Container Platform 4.14.22 packages and security update
- Red Hat OpenShift Container Platform 4.14 buildah-1:1.29.1-10.4.rhaos4.14.el8, buildah-1:1.29.1-10.4.rhaos4.14.el9, buildah-tests-1:1.29.1-10.4.rhaos4.14.el8 +47
- RHSA-2024:1763 Released 2024-04-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.40 packages and security update
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-2.2.rhaos4.13.el8, buildah-1:1.29.1-2.2.rhaos4.13.el9, buildah-tests-1:1.29.1-2.2.rhaos4.13.el8 +31
- RHSA-2024:1566 Released 2024-04-03 · Red Hat rating ImportantRed Hat build of MicroShift 4.14.19 security update
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9, microshift-greenboot-4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9, microshift-networking-4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9 +2
- RHSA-2024:1567 Released 2024-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.14.19 security update
- Red Hat OpenShift Container Platform 4.14 butane-0.19.0-1.3.rhaos4.14.el8, butane-redistributable-0.19.0-1.3.rhaos4.14.el8, containernetworking-plugins-1:1.4.0-1.2.rhaos4.14.el8 +29
- RHSA-2024:1574 Released 2024-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.12.54 packages and security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-5.2.rhaos4.12.el8, buildah-1:1.23.4-5.2.rhaos4.12.el9, buildah-tests-1:1.23.4-5.2.rhaos4.12.el8 +35
- RHSA-2024:1561 Released 2024-04-02 · Red Hat rating ImportantRed Hat build of MicroShift 4.15.6 security update
- Red Hat OpenShift Container Platform 4.15 microshift-4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9, microshift-greenboot-4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9, microshift-networking-4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9 +4
- RHSA-2024:1563 Released 2024-04-02 · Red Hat rating ImportantOpenShift Container Platform 4.15.6 packages and security update
- Red Hat OpenShift Container Platform 4.15 buildah-1:1.29.1-20.3.rhaos4.15.el8, buildah-1:1.29.1-20.3.rhaos4.15.el9, buildah-tests-1:1.29.1-20.3.rhaos4.15.el8 +35
- RHSA-2024:1644 Released 2024-04-02 · Red Hat rating Importantgrafana-pcp security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-5.1.1-2.el8_9
- RHSA-2024:1646 Released 2024-04-02 · Red Hat rating Importantgrafana security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-8.el8_9
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
- RHSA-2024:1501 Released 2024-03-25 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-8.el9_3
- RHSA-2024:1502 Released 2024-03-25 · Red Hat rating Importantgrafana-pcp security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-2.el9_3
- RHSA-2024:1472 Released 2024-03-21 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.20.2-1.module+el8.9.0+18926+5193682d.src::go-toolset:rhel8, delve-1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8, go-toolset-1.20.12-1.module+el8.9.0+21033+5795bdf6.aarch64::go-toolset:rhel8 +17
- RHSA-2024:1468 Released 2024-03-21 · Red Hat rating Importantgo-toolset-1.19-golang security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.13-6.el7_9, go-toolset-1.19-golang-bin-1.19.13-6.el7_9, go-toolset-1.19-golang-docs-1.19.13-6.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.13-6.el7_9, go-toolset-1.19-golang-bin-1.19.13-6.el7_9, go-toolset-1.19-golang-docs-1.19.13-6.el7_9 +4
- RHSA-2024:1462 Released 2024-03-21 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.20.12-2.el9_3, golang-1.20.12-2.el9_3, golang-bin-1.20.12-2.el9_3 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Will not fix |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Service Interconnect 1 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1640 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:1468 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:1468 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:1472, RHSA-2024:1644, RHSA-2024:1646, RHSA-2024:3265, RHSA-2024:5258, RHSA-2024:7262 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:1462, RHSA-2024:1501, RHSA-2024:1502, RHSA-2024:2562, RHSA-2024:2568, RHSA-2024:2569, RHSA-2024:4371, RHSA-2024:4378, RHSA-2024:4379, RHSA-2024:4502, RHSA-2024:4761, RHSA-2024:4762, RHSA-2025:7118 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:4581, RHSA-2024:4672 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4146, RHSA-2024:5634 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:1574 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:1763 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:1566, RHSA-2024:1567, RHSA-2024:1897, RHSA-2024:4960 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:1561, RHSA-2024:1563, RHSA-2024:4699 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:3352 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:2729, RHSA-2024:2730, RHSA-2024:2767 |
Not affected: 17 products
- OpenShift Pipelines
- RHODF 4.16 for RHEL 9
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Virtualization 4
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1394
- 2026-10-03 Alias added: GHSA-78hx-gp6g-7mj6
- 2026-10-07 Affected versions changed · CNA
- 2026-10-08 Affected versions changed · CNA
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 Fix available: openshift/[email protected], openshift/[email protected] · CNA
- 2026-10-29 Affected versions changed · CNA
- 2026-11-04 Affected versions changed · CNA
References
Advisory 40
- RHSA-2024:1462
- RHSA-2024:1468
- RHSA-2024:1472
- RHSA-2024:1501
- RHSA-2024:1502
- RHSA-2024:1561
- RHSA-2024:1563
- RHSA-2024:1566
- RHSA-2024:1567
- RHSA-2024:1574
- RHSA-2024:1640
- RHSA-2024:1644
- RHSA-2024:1646
- RHSA-2024:1763
- RHSA-2024:1897
- RHSA-2024:2562
- RHSA-2024:2568
- RHSA-2024:2569
- RHSA-2024:2729
- RHSA-2024:2730
- RHSA-2024:2767
- RHSA-2024:3265
- RHSA-2024:3352
- RHSA-2024:4146
- RHSA-2024:4371
- RHSA-2024:4378
- RHSA-2024:4379
- RHSA-2024:4502
- RHSA-2024:4581
- RHSA-2024:4591
- RHSA-2024:4672
- RHSA-2024:4699
- RHSA-2024:4761
- RHSA-2024:4762
- RHSA-2024:4960
- RHSA-2024:5258
- RHSA-2024:5634
- RHSA-2024:7262
- RHSA-2025:7118
- https://nvd.nist.gov/vuln/detail/CVE-2024-1394
Other 10
- https://access.redhat.com/security/cve/CVE-2024-1394
- RHBZ#2262921
- https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
- https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
- https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
- https://pkg.go.dev/vuln/GO-2024-2660
- https://vuln.go.dev/ID/GO-2024-2660.json
- https://github.com/golang-fips/openssl
- https://github.com/golang-fips/openssl/releases/tag/v2.0.1
- https://github.com/microsoft/go-crypto-openssl/releases/tag/v0.2.9
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-1394 · CVE Program
- CVE-2024-1394 · NVD
- FIRST EPSS
- GHSA-78hx-gp6g-7mj6 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1394 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences