Skip to content
Fencer Vulns
medium 6.5

CVE-2024-9355 json

Golang-fips: golang fips zeroed buffer

published 2024-10-01 2 y ago modified 2026-11-05 3 d ago also GHSA-3h3x-2hwv-hr52 , GO-2024-3167 , EUVD-2024-2916

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.10-2.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:5.1.1-9.el8_10, 0:9.2.10-20.el8_10, 0:101.5-2.el8_10, 8100020241001112709.a3795dee
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 1:0.2.0-6.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 1:0.2.0-6.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:46.3-8.el8_6, 1:0.2.1-14.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:46.3-8.el8_6, 1:0.2.1-14.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:75-10.el8_8, 1:0.2.2-1.el8_8.3
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:75-10.el8_8, 1:0.2.2-1.el8_8.3
  • Red Hat Red Hat Enterprise Linux 9 0:1.21.13-4.el9_4, 0:3.6.1-1.el9, 0:9.2.10-19.el9_4, 0:132-1.el9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:0.17.0-1.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:5.1.1-4.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:0.23.0-1.el9_6.1
  • Red Hat Satellite Client 6 for RHEL 10 0:0.3.1-1.el10sat
  • Red Hat Satellite Client 6 for RHEL 8 0:0.3.1-1.el8sat
  • Red Hat Satellite Client 6 for RHEL 9 0:0.3.1-1.el9sat
  • Red Hat Red Hat Trusted Artifact Signer 1.3 1787305413
  • osbuild-composer RHEL 8 101.5-2.el8_10
  • osbuild-composer-core RHEL 8 101.5-2.el8_10
  • osbuild-composer-worker RHEL 8 101.5-2.el8_10
  • osbuild-composer RHEL 9 132-1.el9
  • osbuild-composer-core RHEL 9 132-1.el9
  • osbuild-composer-worker RHEL 9 132-1.el9
  • yggdrasil RHEL 6 SATELLITE_CLIENT 0.2.3-3.el8sat
  • yggdrasil RHEL 6 SATELLITE_CLIENT 0.2.3-3.el9sat

red hat advisories RHSA-2026:69235RHSA-2026:68504RHSA-2026:66016RHSA-2026:55520RHSA-2026:55525RHSA-2025:7118

  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 0.0.20241030T212825-150000.1.9.1

suse advisories SUSE-SU-2024:3911-1

  • govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20241030T212825-1.1

opensuse advisories openSUSE-SU-2024:0350-1openSUSE-SU-2024:14447-1

  • osbuild-composer AlmaLinux 8 101.5-2.el8_10.alma.1
  • osbuild-composer-core AlmaLinux 8 101.5-2.el8_10.alma.1
  • osbuild-composer-worker AlmaLinux 8 101.5-2.el8_10.alma.1
  • osbuild AlmaLinux 9 141-1.el9.alma.1
  • osbuild-composer AlmaLinux 9 132-1.el9.alma.1
  • osbuild-lvm2 AlmaLinux 9 141-1.el9.alma.1
  • osbuild-luks2 AlmaLinux 9 141-1.el9.alma.1
  • osbuild-ostree AlmaLinux 9 141-1.el9.alma.1

almalinux advisories ALSA-2026:66016ALSA-2025:7118ALSA-2025:7256ALSA-2024:8847ALSA-2024:8678ALSA-2024:8327

  • osbuild-composer Rocky Linux 8 101.5-2.el8_10.rocky.0.6
  • git-lfs Rocky Linux 9 3.6.1-1.el9
  • grafana Rocky Linux 9 9.2.10-19.el9_4
  • grafana-pcp Rocky Linux 8 5.1.1-9.el8_10
  • golang Rocky Linux 9 1.21.13-4.el9_4
  • delve Rocky Linux 8 1.21.2-4.module+el8.10.0+1868+7f5969f2
  • golang Rocky Linux 8 1.21.13-3.module+el8.10.0+1873+81c21cb9
  • go-toolset Rocky Linux 8 1.21.13-1.module+el8.10.0+1868+7f5969f2

rocky linux advisories RLSA-2026:66016RLSA-2025:7256RLSA-2024:8678RLSA-2024:8847RLSA-2024:7550RLSA-2024:7502

  • golang Azure Linux 3.0 1.22.9-1

azure linux advisories AZL-52774

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-9355 updated cvss 6.5

golang-fips: Golang FIPS zeroed buffer

  • Red Hat NBDE Tang Server tang-operator-bundle-container
    affected: workaround, no fix available
  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-clients
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 1.2 helm, openshift-clients
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 receptor
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 skopeo Red Hat Enterprise Linux 8 rhc, runc, podman, skopeo, buildah, git-lfs, +11 more
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 9 runc, butane, podman, skopeo, buildah, ignition, +17 more
    affected: workaround, no fix available, no fix planned “Will not fix”
show 22 more
  • Red Hat OpenShift Container Platform 4 runc, butane, podman, skopeo, buildah, ignition, +46 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Openshift Container Storage 4 mcg
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/gitops-operator-bundle Red Hat OpenShift on AWS rosa
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 kubevirt
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Satellite 6 yggdrasil, qpid-proton, qpid-proton-c, qpid-proton-cpp, qpid-proton-tests, python-qpid-proton, +2 more Red Hat Service Interconnect 1 qpid-proton, skupper-router skupper-router Red Hat Storage 3 heketi, heketi-client, python-heketi
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-20.el8_10, grafana-pcp 5.1.1-9.el8_10, osbuild-composer 101.5-2.el8_10, grafana-selinux 9.2.10-20.el8_10, osbuild-composer-core 101.5-2.el8_10, osbuild-composer-worker 101.5-2.el8_10, +7 more
    fixed: vendor fix RHSA-2024:7502
  • Red Hat Enterprise Linux AppStream (v. 9) git-lfs 3.6.1-1.el9, golang 1.21.13-4.el9_4, grafana 9.2.10-19.el9_4, go-toolset 1.21.13-4.el9_4, golang-bin 1.21.13-4.el9_4, golang-src 1.21.13-4.el9_4, +6 more
    fixed: vendor fix RHSA-2024:7550
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) rhc 0.2.0-6.el8_4.2
    fixed: vendor fix RHSA-2026:92217
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) rhc 0.2.1-14.el8_6.1, osbuild-composer 46.3-8.el8_6, osbuild-composer-core 46.3-8.el8_6, osbuild-composer-worker 46.3-8.el8_6, osbuild-composer-dnf-json 46.3-8.el8_6
    fixed: vendor fix RHSA-2026:69235
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) rhc 0.2.2-1.el8_8.3, osbuild-composer 75-10.el8_8, osbuild-composer-core 75-10.el8_8, osbuild-composer-worker 75-10.el8_8, osbuild-composer-dnf-json 75-10.el8_8
    fixed: vendor fix RHSA-2026:68504
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) butane 0.17.0-1.el9_2.1
    fixed: vendor fix RHSA-2026:55525
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) grafana-pcp 5.1.1-4.el9_4
    fixed: vendor fix RHSA-2024:9551
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) butane 0.23.0-1.el9_6.1
    fixed: vendor fix RHSA-2026:55520
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) rhc 0.2.0-6.el8_4.2
    fixed: vendor fix RHSA-2026:92217
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) rhc 0.2.1-14.el8_6.1, osbuild-composer 46.3-8.el8_6, osbuild-composer-core 46.3-8.el8_6, osbuild-composer-worker 46.3-8.el8_6, osbuild-composer-dnf-json 46.3-8.el8_6
    fixed: vendor fix RHSA-2026:69235
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) rhc 0.2.2-1.el8_8.3, osbuild-composer 75-10.el8_8, osbuild-composer-core 75-10.el8_8, osbuild-composer-worker 75-10.el8_8, osbuild-composer-dnf-json 75-10.el8_8
    fixed: vendor fix RHSA-2026:68504
  • Red Hat Enterprise Linux Server (v. 7 ELS) rhc-worker-script 0.10-2.el7_9
    fixed: vendor fix RHSA-2024:10133
  • Red Hat Trusted Artifact Signer 1.3 rhtas/fulcio-rhel9 1787305413
    fixed: vendor fix RHSA-2026:59439
  • Red Hat Satellite Client 6 for RHEL 8 foreman_ygg_worker 0.3.1-1.el8sat Red Hat Satellite Client 6 for RHEL 9 foreman_ygg_worker 0.3.1-1.el9sat Red Hat Satellite Client 6 for RHEL 10 foreman_ygg_worker 0.3.1-1.el10sat
    fixed: vendor fix RHSA-2025:7624
  • Red Hat Streams for Apache Kafka 2.9.0
    fixed: vendor fix RHSA-2025:2416
  • Red Hat Ansible Automation Platform 2 automation-gateway-proxy
    not affected: component not present
  • Red Hat Enterprise Linux 7 host-metering, host-metering-selinux Red Hat Enterprise Linux 8 conmon, rsyslog, toolbox, rsyslog-relp, rsyslog-snmp, weldr-client, +17 more Red Hat Enterprise Linux 9 conmon, rsyslog, toolbox, rsyslog-relp, rsyslog-snmp, rsyslog-kafka, +17 more Red Hat Enterprise Linux 10 delve, butane, conmon, podman, skopeo, buildah, +12 more Red Hat Enterprise Linux AppStream (v. 9) osbuild 141-1.el9, osbuild-lvm2 141-1.el9, osbuild-luks2 141-1.el9, osbuild-ostree 141-1.el9, osbuild-selinux 141-1.el9, python3-osbuild 141-1.el9, +1 more
    not affected: vulnerable code not present

11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
GitHub 3.1 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
go github.com/golang-fips/openssl
<=2.0.3
all versions
 no fix listed

Affected products

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Satellite Client 6 for RHEL 10
  • Red Hat Satellite Client 6 for RHEL 8
  • Red Hat Satellite Client 6 for RHEL 9
  • Red Hat Streams for Apache Kafka 2.9.0
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat NBDE Tang Server
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat Ansible Automation Platform 1.2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Openshift Container Storage 4
  • Red Hat Red Hat Openshift Data Foundation 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift on AWS
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Service Interconnect 1
  • Red Hat Red Hat Storage 3

Classification

Weakness
  • CWE-457 Use of Uninitialized Variable

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.