Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD6.5 Medium

CVE-2024-9355

Golang-fips: golang fips zeroed buffer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

github.com/golang-fips/openssl

Default version status: affected

Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

Default version status: affected

  • 0:0.10-2.el7_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 8100020241001112709.a3795dee to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:9.2.10-20.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:5.1.1-9.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:101.5-2.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Default version status: affected

  • 1:0.2.0-6.el8_4.2 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Default version status: affected

  • 1:0.2.0-6.el8_4.2 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Default version status: affected

  • 0:46.3-8.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Default version status: affected

  • 1:0.2.1-14.el8_6.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Default version status: affected

  • 0:46.3-8.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Default version status: affected

  • 1:0.2.1-14.el8_6.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Default version status: affected

  • 0:75-10.el8_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Default version status: affected

  • 1:0.2.2-1.el8_8.3 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Default version status: affected

  • 0:75-10.el8_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Default version status: affected

  • 1:0.2.2-1.el8_8.3 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:1.21.13-4.el9_4 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:9.2.10-19.el9_4 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:132-1.el9 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.6.1-1.el9 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Default version status: affected

  • 0:0.17.0-1.el9_2.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support

Default version status: affected

  • 0:5.1.1-4.el9_4 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Default version status: affected

  • 0:0.23.0-1.el9_6.1 to < *unaffected

Red Hat Satellite Client 6 for RHEL 10

Default version status: affected

  • 0:0.3.1-1.el10sat to < *unaffected

Red Hat Satellite Client 6 for RHEL 8

Default version status: affected

  • 0:0.3.1-1.el8sat to < *unaffected

Red Hat Satellite Client 6 for RHEL 9

Default version status: affected

  • 0:0.3.1-1.el9sat to < *unaffected

Red Hat Streams for Apache Kafka 2.9.0

Default version status: unaffected

Red Hat Red Hat Trusted Artifact Signer 1.3

Default version status: affected

  • 1787305413 to < *unaffected

Red Hat NBDE Tang Server

Default version status: affected

Red Hat OpenShift Developer Tools and Services

Default version status: affected

Red Hat OpenShift Developer Tools and Services

Default version status: affected

Red Hat OpenShift Pipelines

Default version status: affected

Red Hat OpenShift Serverless

Default version status: affected

Red Hat Red Hat Ansible Automation Platform 1.2

Default version status: affected

Red Hat Red Hat Ansible Automation Platform 1.2

Default version status: affected

Red Hat Red Hat Ansible Automation Platform 2

Default version status: unaffected

Red Hat Red Hat Ansible Automation Platform 2

Default version status: affected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 7

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unknown

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat Openshift Container Storage 4

Default version status: affected

Red Hat Red Hat Openshift Data Foundation 4

Default version status: unaffected

Red Hat Red Hat OpenShift Dev Spaces

Default version status: unaffected

Red Hat Red Hat OpenShift GitOps

Default version status: affected

Red Hat Red Hat OpenShift on AWS

Default version status: affected

Red Hat Red Hat OpenShift Virtualization 4

Default version status: affected

Red Hat Red Hat OpenStack Platform 16.2

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 16.2

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 16.2

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 16.2

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 17.1

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 17.1

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 17.1

Default version status: unaffected

Red Hat Red Hat OpenStack Platform 17.1

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: affected

Red Hat Red Hat Satellite 6

Default version status: affected

Red Hat Red Hat Satellite 6

Default version status: affected

Red Hat Red Hat Satellite 6

Default version status: affected

Red Hat Red Hat Service Interconnect 1

Default version status: affected

Red Hat Red Hat Service Interconnect 1

Default version status: unaffected

Red Hat Red Hat Service Interconnect 1

Default version status: affected

Red Hat Red Hat Storage 3

Default version status: affected

References