A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-selinuxUpgrade golang-miscUpgrade osbuild-composer-coreUpgrade golangUpgrade python3-osbuildUpgrade golang-testsUpgrade golang-srcUpgrade osbuild-depsolve-dnfUpgrade osbuildUpgrade golang-binUpgrade git-lfsUpgrade osbuild-luks2Upgrade go-toolsetUpgrade osbuild-selinuxUpgrade grafanaUpgrade osbuild-composer-workerUpgrade grafana-pcpUpgrade osbuild-lvm2Upgrade golang-docsUpgrade osbuild-composerUpgrade delveUpgrade osbuild-ostree | Oct 7, 2024 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade osbuild-depsolve-dnfUpgrade grafanaUpgrade golangUpgrade git-lfsUpgrade osbuild-luks2Upgrade go-toolsetUpgrade osbuild-composer-workerUpgrade golang-docsUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuildUpgrade golang-srcUpgrade osbuild-ostreeUpgrade osbuild-composerUpgrade golang-testsUpgrade golang-miscUpgrade python3-osbuildUpgrade golang-binUpgrade grafana-selinuxUpgrade delveUpgrade osbuild-composer-coreUpgrade grafana-pcp | Oct 16, 2024 | Sep 30, 2024 |
| Redhat_linux | — | Upgrade golang-testsUpgrade grafana-debuginfoUpgrade osbuild-composer-core-debuginfoNo solution existsUpgrade rhc-worker-scriptUpgrade golangUpgrade git-lfs-debugsourceUpgrade grafana-pcp-debuginfoUpgrade grafana-selinuxUpgrade butaneUpgrade grafana-pcp-debugsourceUpgrade butane-debugsourceUpgrade osbuildUpgrade osbuild-lvm2Upgrade golang-miscUpgrade golang-binUpgrade osbuild-composer-coreUpgrade golang-srcUpgrade butane-debuginfoUpgrade osbuild-ostreeUpgrade osbuild-luks2Upgrade osbuild-composer-worker-debuginfoUpgrade osbuild-selinuxUpgrade osbuild-composer-workerUpgrade grafana-pcpUpgrade osbuild-composer-tests-debuginfoUpgrade golang-docsUpgrade osbuild-composerUpgrade go-toolsetUpgrade grafanaUpgrade grafana-debugsourceUpgrade osbuild-depsolve-dnfUpgrade git-lfsUpgrade osbuild-composer-debugsourceUpgrade python3-osbuildUpgrade osbuild-composer-debuginfoUpgrade git-lfs-debuginfo | Oct 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade grafana-debuginfoUpgrade golang-binUpgrade git-lfs-debuginfoUpgrade osbuild-composer-coreUpgrade delve-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade grafana-pcp-debugsourceUpgrade grafana-selinuxUpgrade golangUpgrade git-lfs-debugsourceUpgrade grafana-pcp-debuginfoUpgrade grafanaUpgrade osbuild-composerUpgrade delveUpgrade osbuild-composer-debugsourceUpgrade grafana-debugsourceUpgrade grafana-pcpUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade git-lfsUpgrade delve-debuginfoUpgrade go-toolsetUpgrade osbuild-composer-worker | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub