Vulnerability · Published Oct 1, 2024 · Assigned by redhat
CVE-2024-9355Golang-fips: golang fips zeroed buffer
Medium 6.5
In plain English
A medium-severity security flaw in github.com/golang-fips/openssl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.21.2-4.module_el8.10.0+3895+92d465e0 | ALSA-2024:7502 |
| AlmaLinux:9 | git-lfs | 3.6.1-1.el9 | ALSA-2025:7256 |
| AlmaLinux:8 | go-toolset | 1.21.13-1.module_el8.10.0+3895+92d465e0 | ALSA-2024:7502 |
| AlmaLinux:9 | go-toolset | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang-bin | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang-bin | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang-docs | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang-docs | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang-misc | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang-misc | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang-src | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang-src | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | golang-tests | 1.21.13-3.module_el8.10.0+3900+bb1e1982 | ALSA-2024:7502 |
| AlmaLinux:9 | golang-tests | 1.21.13-4.el9_4 | ALSA-2024:7550 |
| AlmaLinux:8 | grafana | 9.2.10-20.el8_10 | ALSA-2024:8327 |
| AlmaLinux:9 | grafana | 9.2.10-19.el9_4 | ALSA-2024:8678 |
| AlmaLinux:8 | grafana-pcp | 5.1.1-9.el8_10 | ALSA-2024:8847 |
| AlmaLinux:8 | grafana-selinux | 9.2.10-20.el8_10 | ALSA-2024:8327 |
| AlmaLinux:9 | grafana-selinux | 9.2.10-19.el9_4 | ALSA-2024:8678 |
| AlmaLinux:9 | osbuild | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer-core | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-core | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:8 | osbuild-composer-worker | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-worker | 132-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-depsolve-dnf | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-luks2 | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-lvm2 | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-ostree | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | osbuild-selinux | 141-1.el9.alma.1 | ALSA-2025:7118 |
| AlmaLinux:9 | python3-osbuild | 141-1.el9.alma.1 | ALSA-2025:7118 |
| Go | github.com/golang-fips/openssl | no fix listed | GO-2024-3167 |
| Go | github.com/golang-fips/openssl | no fix listed | GHSA-3h3x-2hwv-hr52 |
| Rocky Linux:8 | delve | 0:1.21.2-4.module+el8.10.0+1868+7f5969f2 | RLSA-2024:7502 |
| Rocky Linux:9 | git-lfs | 0:3.6.1-1.el9 | RLSA-2025:7256 |
| Rocky Linux:8 | go-toolset | 0:1.21.13-1.module+el8.10.0+1868+7f5969f2 | RLSA-2024:7502 |
| Rocky Linux:8 | golang | 0:1.21.13-3.module+el8.10.0+1873+81c21cb9 | RLSA-2024:7502 |
| Rocky Linux:9 | golang | 0:1.21.13-4.el9_4 | RLSA-2024:7550 |
| Rocky Linux:8 | grafana | 0:9.2.10-20.el8_10 | RLSA-2024:8327 |
| Rocky Linux:9 | grafana | 0:9.2.10-19.el9_4 | RLSA-2024:8678 |
| Rocky Linux:8 | grafana-pcp | 0:5.1.1-9.el8_10 | RLSA-2024:8847 |
| Rocky Linux:8 | osbuild-composer | 0:101.5-2.el8_10.rocky.0.6 | RLSA-2026:66016 |
Affected products (as reported)
Weakness: CWE-457 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- RHSA-2024:10133 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:7502 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:7550 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:8327 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:8678 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:8847 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9551 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:2416 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7118 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7256 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7624 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:55520 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:55525 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:59439 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:66016 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68504 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:69235 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:90725 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:90726 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:92217 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-9355 vdb-entry, x_refsource_REDHAT
- RHBZ#2315719 issue-tracking, x_refsource_REDHAT
- https://github.com/golang-fips/openssl/pull/198