Medium severity6.5GHSA Advisory· Published Oct 1, 2024· Updated Sep 21, 2026
CVE-2024-9355
CVE-2024-9355
Description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
30- osv-coords29 versionspkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/almalinux/osbuild-depsolve-dnfpkg:rpm/almalinux/grafanapkg:rpm/almalinux/delvepkg:rpm/almalinux/golang-docspkg:rpm/almalinux/go-toolsetpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.5pkg:rpm/almalinux/osbuildpkg:rpm/almalinux/osbuild-luks2pkg:rpm/almalinux/golang-binpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6pkg:rpm/almalinux/osbuild-composer-corepkg:rpm/almalinux/osbuild-selinuxpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Package%20Hub%2012pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/python3-osbuildpkg:rpm/almalinux/osbuild-composer-workerpkg:rpm/almalinux/osbuild-lvm2pkg:rpm/almalinux/git-lfspkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5pkg:rpm/almalinux/golang-miscpkg:rpm/almalinux/golang-srcpkg:rpm/almalinux/golang-testspkg:rpm/almalinux/grafana-selinuxpkg:rpm/almalinux/grafana-pcppkg:golang/github.com/golang-fips/opensslpkg:rpm/almalinux/golangpkg:rpm/almalinux/osbuild-composerpkg:rpm/almalinux/osbuild-ostree
< 0.0.20241030T212825-150000.1.9.1+ 28 more
- (no CPE)range: < 0.0.20241030T212825-150000.1.9.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 9.2.10-20.el8_10
- (no CPE)range: < 1.21.2-4.module_el8.10.0+3895+92d465e0
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 1.21.13-1.module_el8.10.0+3895+92d465e0
- (no CPE)range: < 0.0.20241030T212825-150000.1.9.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 0.0.20241030T212825-150000.1.9.1
- (no CPE)range: < 132-1.el9.alma.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 0.0.20241104T154416-5.1
- (no CPE)range: < 0.0.20241030T212825-1.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 132-1.el9.alma.1
- (no CPE)range: < 141-1.el9.alma.1
- (no CPE)range: < 3.6.1-1.el9
- (no CPE)range: < 0.0.20241030T212825-150000.1.9.1
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 9.2.10-20.el8_10
- (no CPE)range: < 5.1.1-9.el8_10
- (no CPE)range: <= 2.0.3
- (no CPE)range: < 1.21.13-3.module_el8.10.0+3900+bb1e1982
- (no CPE)range: < 132-1.el9.alma.1
- (no CPE)range: < 141-1.el9.alma.1
- Range: <= 2.0.3
Patches
Vulnerability mechanics
References
24- github.com/advisories/GHSA-3h3x-2hwv-hr52ghsaADVISORY
- access.redhat.com/errata/RHSA-2024:10133nvd
- access.redhat.com/errata/RHSA-2024:7502nvd
- access.redhat.com/errata/RHSA-2024:7550nvd
- access.redhat.com/errata/RHSA-2024:8327nvd
- access.redhat.com/errata/RHSA-2024:8678nvd
- access.redhat.com/errata/RHSA-2024:8847nvd
- access.redhat.com/errata/RHSA-2024:9551nvd
- access.redhat.com/errata/RHSA-2025:2416nvd
- access.redhat.com/errata/RHSA-2025:7118nvd
- access.redhat.com/errata/RHSA-2025:7256nvd
- access.redhat.com/errata/RHSA-2025:7624nvd
- access.redhat.com/errata/RHSA-2026:55520nvd
- access.redhat.com/errata/RHSA-2026:55525nvd
- access.redhat.com/errata/RHSA-2026:59439nvd
- access.redhat.com/errata/RHSA-2026:66016nvd
- access.redhat.com/errata/RHSA-2026:68504nvd
- access.redhat.com/errata/RHSA-2026:69235nvd
- access.redhat.com/security/cve/CVE-2024-9355nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/github/advisory-database/pull/4950ghsa
- github.com/golang-fips/openssl/pull/198nvd
- nvd.nist.gov/vuln/detail/CVE-2024-9355ghsa
- pkg.go.dev/vuln/GO-2024-3167ghsa
News mentions
0No linked articles in our index yet.