A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-coreUpgrade grafana-selinuxUpgrade golang-miscUpgrade osbuild-depsolve-dnfUpgrade golangUpgrade golang-testsUpgrade golang-srcUpgrade python3-osbuildUpgrade git-lfsUpgrade osbuildUpgrade delveUpgrade osbuild-ostreeUpgrade go-toolsetUpgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-selinuxUpgrade golang-binUpgrade golang-docsUpgrade osbuild-lvm2Upgrade osbuild-composerUpgrade grafana-pcpUpgrade osbuild-luks2 | Oct 7, 2024 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade grafanaUpgrade git-lfsUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade golangUpgrade osbuild-depsolve-dnfUpgrade go-toolsetUpgrade grafana-pcpUpgrade osbuild-selinuxUpgrade python3-osbuildUpgrade osbuild-composerUpgrade osbuildUpgrade golang-srcUpgrade osbuild-ostreeUpgrade golang-testsUpgrade golang-miscUpgrade golang-docsUpgrade grafana-selinuxUpgrade golang-binUpgrade osbuild-lvm2Upgrade osbuild-composer-coreUpgrade delve | Oct 16, 2024 | Sep 30, 2024 |
| Redhat_linux | — | Upgrade osbuild-composerUpgrade python3-osbuildUpgrade osbuild-composer-debuginfoUpgrade osbuild-selinuxUpgrade git-lfs-debuginfoUpgrade grafana-pcpUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-workerUpgrade git-lfsUpgrade grafanaUpgrade osbuild-composer-worker-debuginfoUpgrade go-toolsetUpgrade grafana-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-luks2Upgrade osbuild-depsolve-dnfUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade rhc-worker-scriptUpgrade grafana-pcp-debuginfoUpgrade grafana-selinuxUpgrade golang-testsUpgrade butane-debugsourceUpgrade butaneNo solution existsUpgrade golang-srcUpgrade grafana-debuginfoUpgrade osbuildUpgrade butane-debuginfoUpgrade git-lfs-debugsourceUpgrade osbuild-ostreeUpgrade grafana-pcp-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-coreUpgrade golang-miscUpgrade osbuild-lvm2 | Oct 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade grafana-debugsourceUpgrade osbuild-composerUpgrade git-lfsUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-debugsourceUpgrade grafanaUpgrade delve-debuginfoUpgrade osbuild-composer-debuginfoUpgrade grafana-pcpUpgrade osbuild-composer-workerUpgrade delveUpgrade go-toolsetUpgrade golangUpgrade grafana-pcp-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade golang-binUpgrade grafana-selinuxUpgrade delve-debugsourceUpgrade grafana-pcp-debuginfoUpgrade git-lfs-debugsourceUpgrade grafana-debuginfoUpgrade git-lfs-debuginfoUpgrade osbuild-composer-core | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub