CVE-2024-9355
Fixed in a distro release EPSS <1%CVSS 6.5
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Satellite Client 6 for RHEL 10, Red Hat Satellite Client 6 for RHEL 8, Red Hat Satellite Client 6 for RHEL 9, Red Hat Streams for Apache Kafka 2.9.0, Red Hat Trusted Artifact Signer 1.3, Red Hat NBDE Tang Server, Red Hat OpenShift Developer Tools and Services, Red Hat OpenShift Pipelines, Red Hat OpenShift Serverless, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat Openshift Container Storage 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift GitOps, Red Hat OpenShift on AWS, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Satellite 6, Red Hat Service Interconnect 1, Red Hat Storage 3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/golang-fips/openssl | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | delve | 1.21.2-4.module_el8.10.0+3895+92d465e0 |
| AlmaLinux 8 | go-toolset | 1.21.13-1.module_el8.10.0+3895+92d465e0 |
| AlmaLinux 8 | golang | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | golang-bin | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | golang-docs | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | golang-misc | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | golang-src | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | golang-tests | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
| AlmaLinux 8 | grafana | 9.2.10-20.el8_10 |
| AlmaLinux 8 | grafana-pcp | 5.1.1-9.el8_10 |
| AlmaLinux 8 | grafana-selinux | 9.2.10-20.el8_10 |
| AlmaLinux 8 | osbuild-composer | 101.5-2.el8_10.alma.1 |
| AlmaLinux 8 | osbuild-composer-core | 101.5-2.el8_10.alma.1 |
| AlmaLinux 8 | osbuild-composer-worker | 101.5-2.el8_10.alma.1 |
| AlmaLinux 9 | git-lfs | 3.6.1-1.el9 |
| AlmaLinux 9 | go-toolset | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang-bin | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang-docs | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang-misc | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang-src | 1.21.13-4.el9_4 |
| AlmaLinux 9 | golang-tests | 1.21.13-4.el9_4 |
| AlmaLinux 9 | grafana | 9.2.10-19.el9_4 |
| AlmaLinux 9 | grafana-selinux | 9.2.10-19.el9_4 |
| AlmaLinux 9 | osbuild | 141-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-composer | 132-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-composer-core | 132-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-composer-worker | 132-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-depsolve-dnf | 141-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-luks2 | 141-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-lvm2 | 141-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-ostree | 141-1.el9.alma.1 |
| AlmaLinux 9 | osbuild-selinux | 141-1.el9.alma.1 |
| AlmaLinux 9 | python3-osbuild | 141-1.el9.alma.1 |
| Red Hat Enterprise Linux 8 | delve | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6 |
| Red Hat Enterprise Linux 8 | golang | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
| Red Hat Enterprise Linux 8 | grafana | 0:9.2.10-20.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-debuginfo | 0:9.2.10-20.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-debugsource | 0:9.2.10-20.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-pcp | 0:5.1.1-9.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-pcp-debuginfo | 0:5.1.1-9.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-pcp-debugsource | 0:5.1.1-9.el8_10 |
| Red Hat Enterprise Linux 8 | grafana-selinux | 0:9.2.10-20.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-core | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-core-debuginfo | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-debuginfo | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-debugsource | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-tests-debuginfo | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-worker | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 8 | osbuild-composer-worker-debuginfo | 0:101.5-2.el8_10 |
| Red Hat Enterprise Linux 9 | git-lfs | 0:3.6.1-1.el9 |
| Red Hat Enterprise Linux 9 | git-lfs-debuginfo | 0:3.6.1-1.el9 |
| Red Hat Enterprise Linux 9 | git-lfs-debugsource | 0:3.6.1-1.el9 |
| Red Hat Enterprise Linux 9 | go-toolset | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang-bin | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang-docs | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang-misc | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang-src | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | golang-tests | 0:1.21.13-4.el9_4 |
| Red Hat Enterprise Linux 9 | grafana | 0:9.2.10-19.el9_4 |
| Red Hat Enterprise Linux 9 | grafana-debuginfo | 0:9.2.10-19.el9_4 |
| Red Hat Enterprise Linux 9 | grafana-debugsource | 0:9.2.10-19.el9_4 |
| Red Hat Enterprise Linux 9 | grafana-selinux | 0:9.2.10-19.el9_4 |
| Red Hat Enterprise Linux 9 | osbuild-composer | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-core | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-core-debuginfo | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-debuginfo | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-debugsource | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-tests-debuginfo | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-worker | 0:132-1.el9 |
| Red Hat Enterprise Linux 9 | osbuild-composer-worker-debuginfo | 0:132-1.el9 |
| Red Hat rhel aus 8.6 | osbuild-composer | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-core | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-core-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-debugsource | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-dnf-json | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-tests-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-worker | 0:46.3-8.el8_6 |
| Red Hat rhel aus 8.6 | osbuild-composer-worker-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel e4s 8.8 | osbuild-composer | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-core | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-core-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-debugsource | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-dnf-json | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-tests-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-worker | 0:75-10.el8_8 |
| Red Hat rhel e4s 8.8 | osbuild-composer-worker-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel e4s 9.2 | butane | 0:0.17.0-1.el9_2.1 |
| Red Hat rhel e4s 9.2 | butane-debuginfo | 0:0.17.0-1.el9_2.1 |
| Red Hat rhel e4s 9.2 | butane-debugsource | 0:0.17.0-1.el9_2.1 |
| Red Hat rhel els 7 | rhc-worker-script | 0:0.10-2.el7_9 |
| Red Hat rhel eus 9.4 | grafana-pcp | 0:5.1.1-4.el9_4 |
| Red Hat rhel eus 9.4 | grafana-pcp-debuginfo | 0:5.1.1-4.el9_4 |
| Red Hat rhel eus 9.4 | grafana-pcp-debugsource | 0:5.1.1-4.el9_4 |
| Red Hat rhel eus 9.6 | butane | 0:0.23.0-1.el9_6.1 |
| Red Hat rhel eus 9.6 | butane-debuginfo | 0:0.23.0-1.el9_6.1 |
| Red Hat rhel eus 9.6 | butane-debugsource | 0:0.23.0-1.el9_6.1 |
| Red Hat rhel eus long life 8.6 | osbuild-composer | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-core | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-core-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-debugsource | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-dnf-json | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-tests-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-worker | 0:46.3-8.el8_6 |
| Red Hat rhel eus long life 8.6 | osbuild-composer-worker-debuginfo | 0:46.3-8.el8_6 |
| Red Hat rhel satellite client 6 | foreman_ygg_worker | 0:0.3.1-1.el8sat |
| Red Hat rhel satellite client 6 | foreman_ygg_worker | 0:0.3.1-1.el10sat |
| Red Hat rhel satellite client 6 | foreman_ygg_worker | 0:0.3.1-1.el9sat |
| Red Hat rhel satellite client 6 | yggdrasil | 0:0.2.3-3.el8sat |
| Red Hat rhel satellite client 6 | yggdrasil | 0:0.2.3-3.el9sat |
| Red Hat rhel tus 8.8 | osbuild-composer | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-core | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-core-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-debugsource | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-dnf-json | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-tests-debuginfo | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-worker | 0:75-10.el8_8 |
| Red Hat rhel tus 8.8 | osbuild-composer-worker-debuginfo | 0:75-10.el8_8 |
| Rocky Linux 8 | delve | 0:1.21.2-4.module+el8.10.0+1868+7f5969f2 |
| Rocky Linux 8 | go-toolset | 0:1.21.13-1.module+el8.10.0+1868+7f5969f2 |
| Rocky Linux 8 | golang | 0:1.21.13-3.module+el8.10.0+1873+81c21cb9 |
| Rocky Linux 8 | grafana | 0:9.2.10-20.el8_10 |
| Rocky Linux 8 | grafana-pcp | 0:5.1.1-9.el8_10 |
| Rocky Linux 8 | osbuild-composer | 0:101.5-2.el8_10.rocky.0.6 |
| Rocky Linux 9 | git-lfs | 0:3.6.1-1.el9 |
| Rocky Linux 9 | golang | 0:1.21.13-4.el9_4 |
| Rocky Linux 9 | grafana | 0:9.2.10-19.el9_4 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| openSUSE Leap 15.5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241030T212825-1.1 |