A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade osbuild-composer-coreUpgrade grafana-selinuxUpgrade python3-osbuildUpgrade golang-miscUpgrade golang-srcUpgrade osbuild-depsolve-dnfUpgrade golang-testsUpgrade golang-docsUpgrade osbuild-lvm2Upgrade osbuildUpgrade osbuild-luks2Upgrade osbuild-composerUpgrade delveUpgrade grafana-pcpUpgrade grafanaUpgrade git-lfsUpgrade go-toolsetUpgrade osbuild-ostreeUpgrade osbuild-composer-workerUpgrade golang-binUpgrade osbuild-selinux | Oct 7, 2024 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade golangUpgrade osbuild-depsolve-dnfUpgrade grafanaUpgrade git-lfsUpgrade go-toolsetUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade golang-miscUpgrade osbuild-selinuxUpgrade python3-osbuildUpgrade golang-binUpgrade grafana-selinuxUpgrade osbuild-composer-coreUpgrade osbuild-lvm2Upgrade golang-srcUpgrade delveUpgrade grafana-pcpUpgrade osbuild-composerUpgrade osbuildUpgrade osbuild-ostreeUpgrade golang-docsUpgrade golang-tests | Oct 16, 2024 | Sep 30, 2024 |
| Redhat_linux | — | Upgrade osbuild-depsolve-dnfUpgrade grafana-debugsourceUpgrade osbuild-composer-debuginfoUpgrade osbuild-selinuxUpgrade osbuild-luks2Upgrade golang-docsUpgrade grafanaUpgrade osbuild-composerUpgrade osbuild-composer-workerUpgrade git-lfs-debuginfoUpgrade grafana-pcpUpgrade python3-osbuildUpgrade osbuild-composer-worker-debuginfoUpgrade git-lfsUpgrade osbuild-composer-debugsourceUpgrade go-toolsetUpgrade osbuild-composer-tests-debuginfoUpgrade golang-binUpgrade osbuild-composer-coreUpgrade golang-testsUpgrade butane-debuginfoUpgrade grafana-pcp-debugsourceUpgrade golang-srcUpgrade golang-miscUpgrade osbuild-lvm2Upgrade git-lfs-debugsourceUpgrade osbuild-ostreeUpgrade golangUpgrade osbuildUpgrade butane-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade grafana-debuginfoUpgrade butaneUpgrade grafana-selinuxNo solution existsUpgrade grafana-pcp-debuginfoUpgrade rhc-worker-script | Oct 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade golang-binUpgrade git-lfs-debugsourceUpgrade grafana-selinuxUpgrade delve-debugsourceUpgrade grafana-pcp-debuginfoUpgrade grafana-pcp-debugsourceUpgrade golangUpgrade grafana-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade git-lfs-debuginfoUpgrade osbuild-composer-coreUpgrade grafana-pcpUpgrade osbuild-composer-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-worker-debuginfoUpgrade grafana-debugsourceUpgrade osbuild-composer-debugsourceUpgrade delve-debuginfoUpgrade grafanaUpgrade git-lfsUpgrade delveUpgrade go-toolsetUpgrade osbuild-composer-worker | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub