Skip to content
fr Sign in
6.5 Medium

CVE-2024-9355 Golang-fips: golang fips zeroed buffer

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
High
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support Versions not published
Satellite Client 6 for RHEL 10 Versions not published
Satellite Client 6 for RHEL 8 Versions not published
Satellite Client 6 for RHEL 9 Versions not published
Streams for Apache Kafka 2.9.0 Versions not published
NBDE Tang Server Versions not published
Show the 29 other branches
Product Affected versions Fixed in
OpenShift Developer Tools and Services Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
Red Hat Ansible Automation Platform 1.2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Container Storage 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Service Interconnect 1 Versions not published
Red Hat Storage 3 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat Trusted Artifact Signer 1.3 1787305413 earliest → < 1787305413 1787305413
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Enterprise Linux 7 Extended Lifecycle Support

The 373 CVEs of Red Hat Enterprise Linux 7 Extended Lifecycle Support →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking 8.6 High CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 8.6 High CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly 8.6 High
Track this CVE