{"id":"CVE-2024-9355","title":"A vulnerability was found in Golang FIPS OpenSSL","summary":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false posi…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-457"],"vendor":"Red Hat","product":"github.com/golang-fips/openssl","affected":["github.com/golang-fips/openssl (all versions)","rhc-worker-script (all versions)","go-toolset:rhel8 (all versions)","grafana (all versions)","grafana-pcp (all versions)","osbuild-composer (all versions)","osbuild-composer (all versions)","osbuild-composer (all versions)","osbuild-composer (all versions)","osbuild-composer (all versions)","golang (all versions)","grafana (all versions)","osbuild-composer (all versions)","git-lfs (all versions)","butane (all versions)","grafana-pcp (all versions)","butane (all versions)","foreman_ygg_worker (all versions)","foreman_ygg_worker (all versions)","foreman_ygg_worker (all versions)","golang-github-danielqsj-kafka_exporter","rhtas/fulcio-rhel9 (all versions)","tang-operator-bundle-container (all versions)","helm (all versions)","odo (all versions)","openshift-pipelines-client (all versions)","openshift-serverless-clients (all versions)","helm (all versions)","openshift-clients (all versions)","automation-gateway-proxy","receptor (all versions)","buildah","butane","conmon","containers-common","delve","git-lfs","golang-github-openprinting-ipp-usb","grafana","grafana-pcp","gvisor-tap-vsock","ignition","osbuild-composer","podman","rsyslog","skopeo","toolbox","yggdrasil","yggdrasil-worker-package-manager","host-metering"],"patched":["satellite_client_6_for_rhel 10","enterprise_linux_server_v_7_els","satellite_client_6_for_rhel 8","satellite_client_6_for_rhel 9","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_appstream_eus_v_9_6","trusted_artifact_signer 1.3","streams_for_apache_kafka 2.9.0"],"published":"2024-10-01","updated":"2026-10-14","sourceUpdated":"2026-10-14T00:17:12.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-9355","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10133","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:7502","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:7550","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8327","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8678","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8847","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:9551","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2416","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:7118","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:7256","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:7624","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:55520","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:55525","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59439","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:66016","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68504","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69235","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-9355","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2315719","label":"secalert@redhat.com"},{"url":"https://github.com/golang-fips/openssl/pull/198","label":"secalert@redhat.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9355"},{"url":"https://pkg.go.dev/vuln/GO-2024-3167"},{"url":"https://github.com/github/advisory-database/pull/4950"},{"url":"https://github.com/advisories/GHSA-3h3x-2hwv-hr52"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9355.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9355"},{"url":"https://github.com/golang-fips/openssl"},{"url":"https://access.redhat.com/errata/RHSA-2026:90725","label":"RHSA-2026:90725"}],"tags":["nvd","cve.org","ghsa","go","csaf","vex","red-hat","osv"],"epss":0.00298,"epssPercentile":0.22309,"aliases":["GHSA-3h3x-2hwv-hr52","GO-2024-3167"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-10-01T18:35:51.670441Z"},"ingestedAt":"2026-08-05T11:47:23.390Z","slug":"CVE-2024-9355","body":"## Overview\n\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2024-9355)\n\nAffected packages:\n\n- `github.com/golang-fips/openssl <= 2.0.3`\n\nSource: https://github.com/advisories/GHSA-3h3x-2hwv-hr52\n\n## Vendor advisories\n\n- **RHSA-2025:7624** · Red Hat · fixed in: Satellite Client 6 for RHEL 10, Satellite Client 6 for RHEL 8, Satellite Client 6 for RHEL 9 · released 2025-05-14 · [advisory](https://access.redhat.com/errata/RHSA-2025:7624)\n- **RHSA-2024:10133** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-11-21 · [advisory](https://access.redhat.com/errata/RHSA-2024:10133)\n- **RHSA-2024:7502** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2024:7502)\n- **RHSA-2024:8327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2024:8327)\n- **RHSA-2024:8847** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-11-05 · [advisory](https://access.redhat.com/errata/RHSA-2024:8847)\n- **RHSA-2026:55525** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55525)\n- **RHSA-2024:9551** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2024-11-13 · [advisory](https://access.redhat.com/errata/RHSA-2024:9551)\n- **RHSA-2024:7550** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2024-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2024:7550)\n- **RHSA-2024:8678** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8678)\n- **RHSA-2025:7256** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7256)\n- **RHSA-2025:7118** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7118)\n- **Red Hat VEX** · Moderate · affected: NBDE Tang Server, OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, … · no fix planned: OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 9, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9355.json)\n- **RHSA-2026:66016** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66016)\n- **RHSA-2026:68504** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68504)\n- **RHSA-2026:69235** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69235)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}