CVE-2024-9355: Golang-fips: golang fips zeroed buffer

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-01 · updated 2026-10-29
Weakness: CWE-457

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

Affected products

github.com/golang-fips/openssl: all versions
Red Hat NBDE Tang Server: all versions
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat OpenShift Developer Tools and Services: all versions
Red Hat OpenShift Pipelines: all versions
Red Hat OpenShift Serverless: all versions
Red Hat Ansible Automation Platform 1.2: all versions
Red Hat Ansible Automation Platform 2: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:0.10-2.el7_9
Red Hat Enterprise Linux 8: all versions — fixed in 8100020241001112709.a3795dee
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 1:0.2.0-6.el8_4.2
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 1:0.2.0-6.el8_4.2
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:46.3-8.el8_6
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:46.3-8.el8_6
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:75-10.el8_8
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:75-10.el8_8
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.21.13-4.el9_4
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:0.17.0-1.el9_2.1
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:5.1.1-4.el9_4
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:0.23.0-1.el9_6.1
Red Hat Openshift Container Storage 4: all versions
Red Hat OpenShift GitOps: all versions
Red Hat OpenShift on AWS: all versions
Red Hat OpenShift Virtualization 4: all versions
Red Hat Service Interconnect 1: all versions
Red Hat Storage 3: all versions
Red Hat Trusted Artifact Signer 1.3: all versions — fixed in 1787305413
Red Hat Satellite 6: all versions
Red Hat Satellite Client 6 for RHEL 10: all versions — fixed in 0:0.3.1-1.el10sat

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.10-2.el7_9; Red Hat Enterprise Linux 8 8100020241001112709.a3795dee; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 1:0.2.0-6.el8_4.2; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 1:0.2.0-6.el8_4.2; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:46.3-8.el8_6; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:46.3-8.el8_6; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:75-10.el8_8; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:75-10.el8_8; Red Hat Enterprise Linux 9 0:1.21.13-4.el9_4; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:0.17.0-1.el9_2.1; Red Hat Enterprise Linux 9.4 Extended Update Support 0:5.1.1-4.el9_4; Red Hat Enterprise Linux 9.6 Extended Update Support 0:0.23.0-1.el9_6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-9355 or the next vulnerability affects your stack