CVE-2024-9355
Golang-fips: golang fips zeroed buffer
Published Oct 1, 2024
CVSS 3.1 · 6.5 Medium
EPSS < 1%
KEV · Not listed
Description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| affected | — | ||||||||
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | affected |
|
||||||
| Red Hat | Satellite Client 6 for RHEL 10 | affected |
|
||||||
| Red Hat | Satellite Client 6 for RHEL 8 | affected |
|
||||||
| Red Hat | Satellite Client 6 for RHEL 9 | affected |
|
||||||
| Red Hat | Streams for Apache Kafka 2.9.0 | unaffected | — | ||||||
| Red Hat | Red Hat Trusted Artifact Signer 1.3 | affected |
|
||||||
| Red Hat | NBDE Tang Server | affected | — | ||||||
| Red Hat | OpenShift Developer Tools and Services | affected | — | ||||||
| Red Hat | OpenShift Developer Tools and Services | affected | — | ||||||
| Red Hat | OpenShift Pipelines | affected | — | ||||||
| Red Hat | OpenShift Serverless | affected | — | ||||||
| Red Hat | Red Hat Ansible Automation Platform 1.2 | affected | — | ||||||
| Red Hat | Red Hat Ansible Automation Platform 1.2 | affected | — | ||||||
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — | ||||||
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 7 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 7 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unknown | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat Openshift Container Storage 4 | affected | — | ||||||
| Red Hat | Red Hat Openshift Data Foundation 4 | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Dev Spaces | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift GitOps | affected | — | ||||||
| Red Hat | Red Hat OpenShift on AWS | affected | — | ||||||
| Red Hat | Red Hat OpenShift Virtualization 4 | affected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 16.2 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 16.2 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 16.2 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 16.2 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 17.1 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 17.1 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 17.1 | unaffected | — | ||||||
| Red Hat | Red Hat OpenStack Platform 17.1 | unaffected | — | ||||||
| Red Hat | Red Hat Satellite 6 | unaffected | — | ||||||
| Red Hat | Red Hat Satellite 6 | unaffected | — | ||||||
| Red Hat | Red Hat Satellite 6 | affected | — | ||||||
| Red Hat | Red Hat Satellite 6 | affected | — | ||||||
| Red Hat | Red Hat Satellite 6 | affected | — | ||||||
| Red Hat | Red Hat Satellite 6 | affected | — | ||||||
| Red Hat | Red Hat Service Interconnect 1 | affected | — | ||||||
| Red Hat | Red Hat Service Interconnect 1 | unaffected | — | ||||||
| Red Hat | Red Hat Service Interconnect 1 | affected | — | ||||||
| Red Hat | Red Hat Storage 3 | affected | — |
No data.
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | |||
| rhc-worker-script-0:0.10-2.el7_9 | cpe:/o:redhat:rhel_els:7 | RHSA-2024:10133 | 2024-11-21T00:00:00Z |
| Red Hat Enterprise Linux 8 | |||
| go-toolset:rhel8-8100020241001112709.a3795dee | cpe:/a:redhat:enterprise_linux:8 | RHSA-2024:7502 | 2024-10-02T00:00:00Z |
| grafana-0:9.2.10-20.el8_10 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2024:8327 | 2024-10-22T00:00:00Z |
| grafana-pcp-0:5.1.1-9.el8_10 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2024:8847 | 2024-11-05T00:00:00Z |
| Red Hat Enterprise Linux 9 | |||
| golang-0:1.21.13-4.el9_4 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2024:7550 | 2024-10-02T00:00:00Z |
| grafana-0:9.2.10-19.el9_4 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2024:8678 | 2024-10-30T00:00:00Z |
| osbuild-composer-0:132-1.el9 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2025:7118 | 2025-05-13T00:00:00Z |
| git-lfs-0:3.6.1-1.el9 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2025:7256 | 2025-05-13T00:00:00Z |
| Red Hat Enterprise Linux 9.4 Extended Update Support | |||
| grafana-pcp-0:5.1.1-4.el9_4 | cpe:/a:redhat:rhel_eus:9.4 | RHSA-2024:9551 | 2024-11-13T00:00:00Z |
| Satellite Client 6 for RHEL 8 | |||
| foreman_ygg_worker-0:0.3.1-1.el8sat | cpe:/a:redhat:rhel_satellite_client:6::el8 | RHSA-2025:7624 | 2025-05-14T00:00:00Z |
| Satellite Client 6 for RHEL 9 | |||
| foreman_ygg_worker-0:0.3.1-1.el9sat | cpe:/a:redhat:rhel_satellite_client:6::el9 | RHSA-2025:7624 | 2025-05-14T00:00:00Z |
| Streams for Apache Kafka 2.9.0 | |||
| golang-github-danielqsj-kafka_exporter | cpe:/a:redhat:amq_streams:2 | RHSA-2025:2416 | 2025-03-05T00:00:00Z |
No data available yet.
Remediation
Vendor Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-2916 | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. |
 Github GHSA |
GHSA-3h3x-2hwv-hr52 | Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability |
Metrics
No CVSS v4.0
Attack Vector Local
Attack Complexity High
Privileges Required Low
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact Low
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.298% probability within 30 days)
Exploitation none
Automatable no
Technical Impact total
References
History
Nov 5, 2026 12:30 PM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
cpe:/a:redhat:enterprise_linux:10 |
Oct 29, 2026 10:15 PM
Affected versions updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| References |
|
Oct 29, 2026 5:30 AM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Oct 27, 2026 6:00 AM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sep 21, 2026 5:30 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Aus
Redhat rhel Eus Long Life |
|
| CPEs | cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
|
| Vendors & Products |
Redhat rhel Aus
Redhat rhel Eus Long Life |
|
| References |
|
Sep 17, 2026 5:45 AM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Tus
|
|
| CPEs | cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Vendors & Products |
Redhat rhel Tus
|
|
| References |
|
Sep 9, 2026 4:30 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Aug 25, 2026 3:15 PM
Affected versions updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:trusted_artifact_signer:1.3::el9 | |
| References |
|
Aug 17, 2026 12:30 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel E4s
|
|
| CPEs | cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/a:redhat:rhel_eus:9.6::appstream |
|
| Vendors & Products |
Redhat rhel E4s
|
|
| References |
|
Jan 21, 2026 11:30 PM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:openshift_devspaces:3 |
Jan 3, 2026 11:45 AM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_satellite_client:6::el10 |
Oct 2, 2025 5:15 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Jul 16, 2025 1:45 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
May 22, 2025 7:30 PM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10 |
May 14, 2025 6:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Satellite Client
|
|
| CPEs | cpe:/a:redhat:rhel_satellite_client:6::el8 cpe:/a:redhat:rhel_satellite_client:6::el9 |
|
| Vendors & Products |
Redhat rhel Satellite Client
|
|
| References |
|
May 13, 2025 8:00 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
May 13, 2025 9:15 AM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mar 5, 2025 10:45 PM
Affected versions updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:amq_streams:2 | |
| References |
|
Dec 10, 2024 4:30 PM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:openshift_devspaces:3: |
Dec 9, 2024 10:30 AM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:openshift_devspaces:3:: |
Nov 21, 2024 8:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:rhel_els:7 | |
| Vendors & Products |
Redhat rhel Els
|
|
| References |
|
Nov 16, 2024 2:45 AM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_eus:9.4 |
Nov 15, 2024 8:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Eus
|
|
| CPEs | cpe:/a:redhat:rhel_eus:9.4::appstream | |
| Vendors & Products |
Redhat rhel Eus
|
|
| References |
|
Nov 5, 2024 8:15 AM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Oct 30, 2024 11:00 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Oct 22, 2024 5:15 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Oct 3, 2024 6:45 PM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9 |
Oct 3, 2024 2:15 AM
Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:8 |
Oct 3, 2024 12:45 AM
Affected versions updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream | |
| References |
|
Oct 2, 2024 5:30 PM
Affected versions updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:8::appstream | |
| References |
|
Oct 1, 2024 7:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Oct 1, 2024 6:30 PM
Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | No description is available for this CVE. | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. |
| Title | golang-fips: Golang FIPS zeroed buffer | Golang-fips: golang fips zeroed buffer |
| First Time appeared |
Redhat
Redhat amq Streams Redhat ansible Automation Platform Redhat container Native Virtualization Redhat enterprise Linux Redhat network Bound Disk Encryption Tang Redhat ocp Tools Redhat openshift Redhat openshift Container Storage Redhat openshift Data Foundation Redhat openshift Devspaces Redhat openshift Gitops Redhat openshift Pipelines Redhat openshift Service On Aws Redhat openstack Redhat satellite Redhat serverless Redhat service Interconnect Redhat storage Redhat trusted Artifact Signer |
|
| CPEs | cpe:/a:redhat:amq_streams:1 cpe:/a:redhat:ansible_automation_platform cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:container_native_virtualization:4 cpe:/a:redhat:network_bound_disk_encryption_tang:1 cpe:/a:redhat:ocp_tools cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift_container_storage:4 cpe:/a:redhat:openshift_data_foundation:4 cpe:/a:redhat:openshift_devspaces:3::el8 cpe:/a:redhat:openshift_gitops:1 cpe:/a:redhat:openshift_pipelines:1 cpe:/a:redhat:openshift_service_on_aws:1 cpe:/a:redhat:openstack:16.2 cpe:/a:redhat:openstack:17.1 cpe:/a:redhat:satellite:6 cpe:/a:redhat:serverless:1 cpe:/a:redhat:service_interconnect:1 cpe:/a:redhat:storage:3 cpe:/a:redhat:trusted_artifact_signer:1 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat amq Streams Redhat ansible Automation Platform Redhat container Native Virtualization Redhat enterprise Linux Redhat network Bound Disk Encryption Tang Redhat ocp Tools Redhat openshift Redhat openshift Container Storage Redhat openshift Data Foundation Redhat openshift Devspaces Redhat openshift Gitops Redhat openshift Pipelines Redhat openshift Service On Aws Redhat openstack Redhat satellite Redhat serverless Redhat service Interconnect Redhat storage Redhat trusted Artifact Signer |
|
| References |
|
Oct 1, 2024 1:15 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | No description is available for this CVE. | |
| Title | golang-fips: Golang FIPS zeroed buffer | |
| Weaknesses | CWE-457 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Subscriptions
Redhat
Subscribe
Amq Streams
Subscribe
Ansible Automation Platform
Subscribe
Container Native Virtualization
Subscribe
Enterprise Linux
Subscribe
Network Bound Disk Encryption Tang
Subscribe
Ocp Tools
Subscribe
Openshift
Subscribe
Openshift Container Storage
Subscribe
Openshift Data Foundation
Subscribe
Openshift Devspaces
Subscribe
Openshift Gitops
Subscribe
Openshift Pipelines
Subscribe
Openshift Service On Aws
Subscribe
Openstack
Subscribe
Rhel Aus
Subscribe
Rhel E4s
Subscribe
Rhel Els
Subscribe
Rhel Eus
Subscribe
Rhel Eus Long Life
Subscribe
Rhel Satellite Client
Subscribe
Rhel Tus
Subscribe
Satellite
Subscribe
Serverless
Subscribe
Service Interconnect
Subscribe
Storage
Subscribe
Trusted Artifact Signer
Subscribe
Weaknesses
