VulnerableCode Package Details - pkg:rpm/redhat/osbuild-composer@132-1?arch=el9

Search for packages

Vulnerability	Summary	Fixed by
VCID-6nrn-u58x-mben Aliases: CVE-2024-1394 GHSA-78hx-gp6g-7mj6	Memory leaks in code encrypting and verifying RSA payloads Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.	There are no reported fixed by versions.
VCID-d97y-w562-fkab Aliases: CVE-2024-9355 GHSA-3h3x-2hwv-hr52	Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.	There are no reported fixed by versions.
VCID-rdqf-wp1t-j7b5 Aliases: CVE-2024-34158	go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-6nrn-u58x-mben
Aliases:
CVE-2024-1394
GHSA-78hx-gp6g-7mj6

Memory leaks in code encrypting and verifying RSA payloads Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads. An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

There are no reported fixed by versions.

VCID-d97y-w562-fkab
Aliases:
CVE-2024-9355
GHSA-3h3x-2hwv-hr52

Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

There are no reported fixed by versions.

VCID-rdqf-wp1t-j7b5
Aliases:
CVE-2024-34158

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T13:48:57.474016+00:00	RedHat Importer	Affected by	VCID-6nrn-u58x-mben	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1394.json	38.0.0
2026-04-01T13:45:25.277260+00:00	RedHat Importer	Affected by	VCID-rdqf-wp1t-j7b5	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-34158.json	38.0.0
2026-04-01T13:44:58.799038+00:00	RedHat Importer	Affected by	VCID-d97y-w562-fkab	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9355.json	38.0.0