A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade osbuild-composer-coreUpgrade grafana-selinuxUpgrade osbuild-depsolve-dnfUpgrade golang-testsUpgrade python3-osbuildUpgrade golang-srcUpgrade golang-miscUpgrade golang-docsUpgrade osbuild-luks2Upgrade osbuild-selinuxUpgrade git-lfsUpgrade osbuild-composerUpgrade delveUpgrade go-toolsetUpgrade golang-binUpgrade grafana-pcpUpgrade osbuildUpgrade osbuild-lvm2Upgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-ostree | Oct 7, 2024 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade grafana-selinuxUpgrade golang-binUpgrade golang-testsUpgrade python3-osbuildUpgrade osbuild-composerUpgrade osbuild-ostreeUpgrade osbuild-composer-coreUpgrade osbuild-lvm2Upgrade delveUpgrade osbuild-selinuxUpgrade golang-miscUpgrade golang-docsUpgrade grafana-pcpUpgrade golang-srcUpgrade osbuildUpgrade osbuild-composer-workerUpgrade go-toolsetUpgrade git-lfsUpgrade grafanaUpgrade osbuild-luks2Upgrade osbuild-depsolve-dnfUpgrade golang | Oct 16, 2024 | Sep 30, 2024 |
| Redhat_linux | — | Upgrade grafana-pcp-debuginfoUpgrade butane-debuginfoUpgrade butane-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade golang-miscUpgrade osbuild-lvm2Upgrade golangUpgrade osbuild-ostreeUpgrade grafana-pcp-debugsourceUpgrade osbuild-composer-coreUpgrade golang-testsUpgrade golang-srcUpgrade grafana-selinuxUpgrade rhc-worker-scriptNo solution existsUpgrade git-lfs-debugsourceUpgrade grafana-debuginfoUpgrade golang-binUpgrade butaneUpgrade osbuildUpgrade grafana-pcpUpgrade osbuild-composer-workerUpgrade git-lfs-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade go-toolsetUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-luks2Upgrade git-lfsUpgrade osbuild-composerUpgrade osbuild-composer-debugsourceUpgrade golang-docsUpgrade python3-osbuildUpgrade grafanaUpgrade osbuild-depsolve-dnfUpgrade grafana-debugsourceUpgrade osbuild-selinuxUpgrade osbuild-composer-debuginfo | Oct 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade grafana-debugsourceUpgrade grafana-pcpUpgrade go-toolsetUpgrade delveUpgrade grafanaUpgrade delve-debuginfoUpgrade git-lfsUpgrade grafana-pcp-debuginfoUpgrade golangUpgrade git-lfs-debugsourceUpgrade golang-binUpgrade grafana-selinuxUpgrade grafana-debuginfoUpgrade git-lfs-debuginfoUpgrade grafana-pcp-debugsourceUpgrade delve-debugsource | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub