The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1462 advisory.

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9 : golang (ALSA-2024:1462)

high Nessus Plugin ID 192477

Version 1.0