CVE-2024-9355Golang-fips: golang fips zeroed buffer
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 7 Extended Lifecycle Support and 25 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- Weakness (CWE)
- CWE-457
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
from 0:0.10-2.el7_9 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 8100020241001112709.a3795dee not affected | CNA record |
from 0:46.3-8.el8_6 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support redhat:rhel_eus_long_life | from 0:46.3-8.el8_6 not affected | CNA record |
from 0:75-10.el8_8 not affected | CNA record | |
from 0:75-10.el8_8 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support redhat:rhel_eus | from 0:5.1.1-4.el9_4 not affected | CNA record |
Red Hat Satellite Client 6 for RHEL 10 redhat:rhel_satellite_client | from 0:0.3.1-1.el10sat not affected | CNA record |
Red Hat Streams for Apache Kafka 2.9.0 redhat:amq_streams | 2 | CNA record |
Red Hat Red Hat Trusted Artifact Signer 1.3 redhat:trusted_artifact_signer | from 1787305413 not affected | CNA record |
Red Hat NBDE Tang Server redhat:network_bound_disk_encryption_tang | 1 | CNA record |
Red Hat OpenShift Developer Tools and Services redhat:ocp_tools | All versions | CNA record |
Red Hat OpenShift Pipelines redhat:openshift_pipelines | 1 | CNA record |
Red Hat OpenShift Serverless redhat:serverless | 1 | CNA record |
Red Hat Red Hat Ansible Automation Platform 1.2 redhat:ansible_automation_platform | All versions | CNA record |
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift | 4 | CNA record |
Red Hat Red Hat Openshift Container Storage 4 redhat:openshift_container_storage | 4 | CNA record |
Red Hat Red Hat Openshift Data Foundation 4 redhat:openshift_data_foundation | 4 | CNA record |
Red Hat Red Hat OpenShift Dev Spaces redhat:openshift_devspaces | 3 | CNA record |
Red Hat Red Hat OpenShift GitOps redhat:openshift_gitops | 1 | CNA record |
Red Hat Red Hat OpenShift on AWS redhat:openshift_service_on_aws | 1 | CNA record |
Red Hat Red Hat OpenShift Virtualization 4 redhat:container_native_virtualization | 4 | CNA record |
Red Hat Red Hat OpenStack Platform 16.2 redhat:openstack | 16.2 | CNA record |
Red Hat Red Hat Satellite 6 redhat:satellite | 6 | CNA record |
Red Hat Red Hat Service Interconnect 1 redhat:service_interconnect | 1 | CNA record |
Red Hat Red Hat Storage 3 redhat:storage | 3 | CNA record |
References
- https://access.redhat.com/errata/RHSA-2024:10133vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:7502vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:7550vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:8327vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:8678vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:8847vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:9551vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2025:2416vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2025:7118vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2025:7256vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2025:7624vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:55520vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:55525vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:59439vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:66016vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68504vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69235vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2024-9355vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2315719issue-tracking, x-refsource-redhat
- https://github.com/golang-fips/openssl/pull/198
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.