A memory leak vulnerability (CVE-2024-1394) exists in the Golang RSA encrypting/decrypting code used in Red Hat Ansible Automation Platform 2.4 for RHEL 8. The leak occurs because the function responsible for freeing memory objects pkey and ctx does not properly release them when errors occur, due to the use of named return parameters and a specific error return pattern that results in nil pointers inside the deferred cleanup function. This flaw can lead to resource exhaustion if attacker-controlled inputs trigger repeated leaks. Red Hat has released security updates for golang packages that fix this issue across various Red Hat Enterprise Linux 9 variants and Red Hat Developer Tools. The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can cause resource exhaustion on affected systems by leaking memory during RSA encryption/decryption operations in Golang code. This results in a denial-of-service condition impacting availability. There is no impact on confidentiality or integrity. No known active exploitation has been reported. The issue affects Red Hat Ansible Automation Platform 2.4 for RHEL 8 and other Red Hat products using the vulnerable golang packages.

Red Hat has released official security updates for golang packages that address this memory leak vulnerability. Users should apply the relevant Red Hat errata and security advisories (RHSA-2024:1462, RHSA-2024:1468) to update golang packages on affected systems. Before applying updates, ensure all previously released errata are applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are required beyond applying the provided patches.