Golang-fips: golang fips zeroed buffer
Published Oct 1, 2024
7.6
HIGHCVSS 4.0
EPSS 0.30%
Description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | NBDE Tang Server | affected |
| |||
| Red Hat | OpenShift Developer Tools and Services | affected |
| |||
| Red Hat | OpenShift Pipelines | affected |
| |||
| Red Hat | OpenShift Serverless | affected |
| |||
| Red Hat | Red Hat Ansible Automation Platform 1.2 | affected |
| |||
| Red Hat | Red Hat Ansible Automation Platform 2 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 7 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
| |||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected |
| |||
| Red Hat | Red Hat OpenShift GitOps | affected |
| |||
| Red Hat | Red Hat OpenShift Virtualization 4 | affected |
| |||
| Red Hat | Red Hat OpenShift on AWS | affected |
| |||
| Red Hat | Red Hat Openshift Container Storage 4 | affected |
| |||
| Red Hat | Red Hat Satellite 6 | affected |
| |||
| Red Hat | Red Hat Service Interconnect 1 | affected |
| |||
| Red Hat | Red Hat Storage 3 | affected |
|
No data.
No data.
Red Hat Enterprise Linux 7 Extended Lifecycle Support
rhc-worker-script-0:0.10-2.el7_9
Fixed · RHSA-2024:10133
Red Hat Enterprise Linux 8
go-toolset:rhel8-8100020241001112709.a3795dee
Fixed · RHSA-2024:7502
Red Hat Enterprise Linux 8
grafana-0:9.2.10-20.el8_10
Fixed · RHSA-2024:8327
Red Hat Enterprise Linux 8
grafana-pcp-0:5.1.1-9.el8_10
Fixed · RHSA-2024:8847
Red Hat Enterprise Linux 8
osbuild-composer-0:101.5-2.el8_10
Fixed · RHSA-2026:66016
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
osbuild-composer-0:46.3-8.el8_6
Fixed · RHSA-2026:69235
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
osbuild-composer-0:46.3-8.el8_6
Fixed · RHSA-2026:69235
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
osbuild-composer-0:75-10.el8_8
Fixed · RHSA-2026:68504
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
osbuild-composer-0:75-10.el8_8
Fixed · RHSA-2026:68504
Red Hat Enterprise Linux 9
git-lfs-0:3.6.1-1.el9
Fixed · RHSA-2025:7256
Red Hat Enterprise Linux 9
golang-0:1.21.13-4.el9_4
Fixed · RHSA-2024:7550
Red Hat Enterprise Linux 9
grafana-0:9.2.10-19.el9_4
Fixed · RHSA-2024:8678
Red Hat Enterprise Linux 9
osbuild-composer-0:132-1.el9
Fixed · RHSA-2025:7118
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
butane-0:0.17.0-1.el9_2.1
Fixed · RHSA-2026:55525
Red Hat Enterprise Linux 9.4 Extended Update Support
grafana-pcp-0:5.1.1-4.el9_4
Fixed · RHSA-2024:9551
Red Hat Enterprise Linux 9.6 Extended Update Support
butane-0:0.23.0-1.el9_6.1
Fixed · RHSA-2026:55520
Red Hat Trusted Artifact Signer 1.3
rhtas/fulcio-rhel9:1787305413
Fixed · RHSA-2026:59439
Satellite Client 6 for RHEL 10
foreman_ygg_worker-0:0.3.1-1.el10sat
Fixed · RHSA-2025:7624
Satellite Client 6 for RHEL 8
foreman_ygg_worker-0:0.3.1-1.el8sat
Fixed · RHSA-2025:7624
Satellite Client 6 for RHEL 9
foreman_ygg_worker-0:0.3.1-1.el9sat
Fixed · RHSA-2025:7624
Streams for Apache Kafka 2.9.0
golang-github-danielqsj-kafka_exporter
Fixed · RHSA-2025:2416
NBDE Tang Server
tang-operator-bundle-container
Affected
OpenShift Developer Tools and Services
helm
Will not fix
OpenShift Developer Tools and Services
odo
Affected
OpenShift Pipelines
openshift-pipelines-client
Affected
OpenShift Serverless
openshift-serverless-clients
Will not fix
Red Hat Ansible Automation Platform 1.2
helm
Affected
Red Hat Ansible Automation Platform 1.2
openshift-clients
Affected
Red Hat Ansible Automation Platform 2
automation-gateway-proxy
Not affected
Red Hat Ansible Automation Platform 2
receptor
Will not fix
Red Hat Enterprise Linux 10
buildah
Not affected
Red Hat Enterprise Linux 10
butane
Not affected
Red Hat Enterprise Linux 10
conmon
Not affected
Red Hat Enterprise Linux 10
containers-common
Not affected
Red Hat Enterprise Linux 10
delve
Not affected
Red Hat Enterprise Linux 10
git-lfs
Not affected
Red Hat Enterprise Linux 10
golang-github-openprinting-ipp-usb
Not affected
Red Hat Enterprise Linux 10
grafana
Not affected
Red Hat Enterprise Linux 10
grafana-pcp
Not affected
Red Hat Enterprise Linux 10
gvisor-tap-vsock
Not affected
Red Hat Enterprise Linux 10
ignition
Not affected
Red Hat Enterprise Linux 10
osbuild-composer
Not affected
Red Hat Enterprise Linux 10
podman
Not affected
Red Hat Enterprise Linux 10
rsyslog
Not affected
Red Hat Enterprise Linux 10
skopeo
Not affected
Red Hat Enterprise Linux 10
toolbox
Not affected
Red Hat Enterprise Linux 10
yggdrasil
Not affected
Red Hat Enterprise Linux 10
yggdrasil-worker-package-manager
Not affected
Red Hat Enterprise Linux 7
host-metering
Affected
Red Hat Enterprise Linux 7
skopeo
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/buildah
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/conmon
Not affected
Red Hat Enterprise Linux 8
container-tools:rhel8/containernetworking-plugins
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/podman
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/runc
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/skopeo
Affected
Red Hat Enterprise Linux 8
container-tools:rhel8/toolbox
Affected
Red Hat Enterprise Linux 8
git-lfs
Affected
Red Hat Enterprise Linux 8
rhc
Affected
Red Hat Enterprise Linux 8
rsyslog
Not affected
Red Hat Enterprise Linux 8
weldr-client
Not affected
Red Hat Enterprise Linux 9
buildah
Affected
Red Hat Enterprise Linux 9
butane
Affected
Red Hat Enterprise Linux 9
conmon
Not affected
Red Hat Enterprise Linux 9
containernetworking-plugins
Will not fix
Red Hat Enterprise Linux 9
grafana-pcp
Affected
Red Hat Enterprise Linux 9
gvisor-tap-vsock
Will not fix
Red Hat Enterprise Linux 9
ignition
Affected
Red Hat Enterprise Linux 9
opentelemetry-collector
Affected
Red Hat Enterprise Linux 9
podman
Will not fix
Red Hat Enterprise Linux 9
rsyslog
Not affected
Red Hat Enterprise Linux 9
runc
Will not fix
Red Hat Enterprise Linux 9
skopeo
Will not fix
Red Hat Enterprise Linux 9
toolbox
Not affected
Red Hat Enterprise Linux 9
weldr-client
Affected
Red Hat OpenShift Container Platform 4
buildah
Affected
Red Hat OpenShift Container Platform 4
butane
Affected
Red Hat OpenShift Container Platform 4
conmon
Not affected
Red Hat OpenShift Container Platform 4
conmon-rs
Not affected
Red Hat OpenShift Container Platform 4
containernetworking-plugins
Affected
Red Hat OpenShift Container Platform 4
cri-o
Not affected
Red Hat OpenShift Container Platform 4
cri-tools
Not affected
Red Hat OpenShift Container Platform 4
golang-github-prometheus-promu
Not affected
Red Hat OpenShift Container Platform 4
ignition
Affected
Red Hat OpenShift Container Platform 4
lifecycle-agent-operator-bundle-container
Affected
Red Hat OpenShift Container Platform 4
microshift
Affected
Red Hat OpenShift Container Platform 4
openshift
Affected
Red Hat OpenShift Container Platform 4
openshift-clients
Not affected
Red Hat OpenShift Container Platform 4
openshift4/bare-metal-event-relay-operator-bundle
Not affected
Red Hat OpenShift Container Platform 4
openshift4/numaresources-operator-bundle
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-aws-efs-csi-driver-container-rhel8
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-gcp-filestore-csi-driver-rhel8
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-secrets-store-csi-driver-rhel8
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-network-metrics-exporter-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-sriov-rdma-cni-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-vertical-pod-autoscaler-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/sriov-network-metrics-exporter-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/topology-aware-lifecycle-manager-operator-bundle
Affected
Red Hat OpenShift Container Platform 4
ose-aws-ecr-image-credential-provider
Not affected
Red Hat OpenShift Container Platform 4
ose-azure-acr-image-credential-provider
Not affected
Red Hat OpenShift Container Platform 4
ose-gcp-gcr-image-credential-provider
Not affected
Red Hat OpenShift Container Platform 4
podman
Affected
Red Hat OpenShift Container Platform 4
runc
Affected
Red Hat OpenShift Container Platform 4
skopeo
Affected
Red Hat OpenShift Dev Spaces
devspaces/machineexec-rhel8
Not affected
Red Hat OpenShift GitOps
openshift-gitops-1/gitops-operator-bundle
Affected
Red Hat OpenShift Virtualization 4
kubevirt
Fix deferred
Red Hat OpenShift on AWS
rosa
Will not fix
Red Hat OpenStack Platform 16.2
etcd
Not affected
Red Hat OpenStack Platform 16.2
golang-github-infrawatch-apputils
Not affected
Red Hat OpenStack Platform 16.2
golang-qpid-apache
Not affected
Red Hat OpenStack Platform 16.2
qpid-proton
Not affected
Red Hat OpenStack Platform 17.1
etcd
Not affected
Red Hat OpenStack Platform 17.1
golang-github-infrawatch-apputils
Not affected
Red Hat OpenStack Platform 17.1
golang-qpid-apache
Not affected
Red Hat OpenStack Platform 17.1
qpid-proton
Not affected
Red Hat Openshift Container Storage 4
mcg
Affected
Red Hat Openshift Data Foundation 4
mcg
Not affected
Red Hat Satellite 6
qpid-proton
Not affected
Red Hat Satellite 6
satellite-capsule:el8/qpid-proton
Not affected
Red Hat Satellite 6
satellite:el8/qpid-proton
Affected
Red Hat Satellite 6
satellite:el8/yggdrasil-worker-forwarder
Affected
Red Hat Satellite 6
yggdrasil
Affected
Red Hat Satellite 6
yggdrasil-worker-forwarder
Affected
Red Hat Service Interconnect 1
qpid-proton
Affected
Red Hat Service Interconnect 1
skupper-cli
Not affected
Red Hat Service Interconnect 1
skupper-router
Affected
Red Hat Storage 3
heketi
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | rhc-worker-script-0:0.10-2.el7_9 | Fixed | RHSA-2024:10133 |
| Red Hat Enterprise Linux 8 | go-toolset:rhel8-8100020241001112709.a3795dee | Fixed | RHSA-2024:7502 |
| Red Hat Enterprise Linux 8 | grafana-0:9.2.10-20.el8_10 | Fixed | RHSA-2024:8327 |
| Red Hat Enterprise Linux 8 | grafana-pcp-0:5.1.1-9.el8_10 | Fixed | RHSA-2024:8847 |
| Red Hat Enterprise Linux 8 | osbuild-composer-0:101.5-2.el8_10 | Fixed | RHSA-2026:66016 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | osbuild-composer-0:46.3-8.el8_6 | Fixed | RHSA-2026:69235 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | osbuild-composer-0:46.3-8.el8_6 | Fixed | RHSA-2026:69235 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | osbuild-composer-0:75-10.el8_8 | Fixed | RHSA-2026:68504 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | osbuild-composer-0:75-10.el8_8 | Fixed | RHSA-2026:68504 |
| Red Hat Enterprise Linux 9 | git-lfs-0:3.6.1-1.el9 | Fixed | RHSA-2025:7256 |
| Red Hat Enterprise Linux 9 | golang-0:1.21.13-4.el9_4 | Fixed | RHSA-2024:7550 |
| Red Hat Enterprise Linux 9 | grafana-0:9.2.10-19.el9_4 | Fixed | RHSA-2024:8678 |
| Red Hat Enterprise Linux 9 | osbuild-composer-0:132-1.el9 | Fixed | RHSA-2025:7118 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | butane-0:0.17.0-1.el9_2.1 | Fixed | RHSA-2026:55525 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | grafana-pcp-0:5.1.1-4.el9_4 | Fixed | RHSA-2024:9551 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | butane-0:0.23.0-1.el9_6.1 | Fixed | RHSA-2026:55520 |
| Red Hat Trusted Artifact Signer 1.3 | rhtas/fulcio-rhel9:1787305413 | Fixed | RHSA-2026:59439 |
| Satellite Client 6 for RHEL 10 | foreman_ygg_worker-0:0.3.1-1.el10sat | Fixed | RHSA-2025:7624 |
| Satellite Client 6 for RHEL 8 | foreman_ygg_worker-0:0.3.1-1.el8sat | Fixed | RHSA-2025:7624 |
| Satellite Client 6 for RHEL 9 | foreman_ygg_worker-0:0.3.1-1.el9sat | Fixed | RHSA-2025:7624 |
| Streams for Apache Kafka 2.9.0 | golang-github-danielqsj-kafka_exporter | Fixed | RHSA-2025:2416 |
| NBDE Tang Server | tang-operator-bundle-container | Affected | n/a |
| OpenShift Developer Tools and Services | helm | Will not fix | n/a |
| OpenShift Developer Tools and Services | odo | Affected | n/a |
| OpenShift Pipelines | openshift-pipelines-client | Affected | n/a |
| OpenShift Serverless | openshift-serverless-clients | Will not fix | n/a |
| Red Hat Ansible Automation Platform 1.2 | helm | Affected | n/a |
| Red Hat Ansible Automation Platform 1.2 | openshift-clients | Affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | receptor | Will not fix | n/a |
| Red Hat Enterprise Linux 10 | buildah | Not affected | n/a |
| Red Hat Enterprise Linux 10 | butane | Not affected | n/a |
| Red Hat Enterprise Linux 10 | conmon | Not affected | n/a |
| Red Hat Enterprise Linux 10 | containers-common | Not affected | n/a |
| Red Hat Enterprise Linux 10 | delve | Not affected | n/a |
| Red Hat Enterprise Linux 10 | git-lfs | Not affected | n/a |
| Red Hat Enterprise Linux 10 | golang-github-openprinting-ipp-usb | Not affected | n/a |
| Red Hat Enterprise Linux 10 | grafana | Not affected | n/a |
| Red Hat Enterprise Linux 10 | grafana-pcp | Not affected | n/a |
| Red Hat Enterprise Linux 10 | gvisor-tap-vsock | Not affected | n/a |
| Red Hat Enterprise Linux 10 | ignition | Not affected | n/a |
| Red Hat Enterprise Linux 10 | osbuild-composer | Not affected | n/a |
| Red Hat Enterprise Linux 10 | podman | Not affected | n/a |
| Red Hat Enterprise Linux 10 | rsyslog | Not affected | n/a |
| Red Hat Enterprise Linux 10 | skopeo | Not affected | n/a |
| Red Hat Enterprise Linux 10 | toolbox | Not affected | n/a |
| Red Hat Enterprise Linux 10 | yggdrasil | Not affected | n/a |
| Red Hat Enterprise Linux 10 | yggdrasil-worker-package-manager | Not affected | n/a |
| Red Hat Enterprise Linux 7 | host-metering | Affected | n/a |
| Red Hat Enterprise Linux 7 | skopeo | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/buildah | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/conmon | Not affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/containernetworking-plugins | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/podman | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/runc | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/skopeo | Affected | n/a |
| Red Hat Enterprise Linux 8 | container-tools:rhel8/toolbox | Affected | n/a |
| Red Hat Enterprise Linux 8 | git-lfs | Affected | n/a |
| Red Hat Enterprise Linux 8 | rhc | Affected | n/a |
| Red Hat Enterprise Linux 8 | rsyslog | Not affected | n/a |
| Red Hat Enterprise Linux 8 | weldr-client | Not affected | n/a |
| Red Hat Enterprise Linux 9 | buildah | Affected | n/a |
| Red Hat Enterprise Linux 9 | butane | Affected | n/a |
| Red Hat Enterprise Linux 9 | conmon | Not affected | n/a |
| Red Hat Enterprise Linux 9 | containernetworking-plugins | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | grafana-pcp | Affected | n/a |
| Red Hat Enterprise Linux 9 | gvisor-tap-vsock | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | ignition | Affected | n/a |
| Red Hat Enterprise Linux 9 | opentelemetry-collector | Affected | n/a |
| Red Hat Enterprise Linux 9 | podman | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | rsyslog | Not affected | n/a |
| Red Hat Enterprise Linux 9 | runc | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | skopeo | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | toolbox | Not affected | n/a |
| Red Hat Enterprise Linux 9 | weldr-client | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | buildah | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | butane | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | conmon | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | conmon-rs | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | containernetworking-plugins | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | cri-tools | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | golang-github-prometheus-promu | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | ignition | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | lifecycle-agent-operator-bundle-container | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | microshift | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-clients | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/bare-metal-event-relay-operator-bundle | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/numaresources-operator-bundle | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-aws-efs-csi-driver-container-rhel8 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-gcp-filestore-csi-driver-rhel8 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-secrets-store-csi-driver-rhel8 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-network-metrics-exporter-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-sriov-rdma-cni-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-vertical-pod-autoscaler-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/sriov-network-metrics-exporter-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/topology-aware-lifecycle-manager-operator-bundle | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | ose-aws-ecr-image-credential-provider | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | ose-azure-acr-image-credential-provider | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | ose-gcp-gcr-image-credential-provider | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | podman | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | runc | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | skopeo | Affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/machineexec-rhel8 | Not affected | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/gitops-operator-bundle | Affected | n/a |
| Red Hat OpenShift Virtualization 4 | kubevirt | Fix deferred | n/a |
| Red Hat OpenShift on AWS | rosa | Will not fix | n/a |
| Red Hat OpenStack Platform 16.2 | etcd | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | golang-github-infrawatch-apputils | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | golang-qpid-apache | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | qpid-proton | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | etcd | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | golang-github-infrawatch-apputils | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | golang-qpid-apache | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | qpid-proton | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | mcg | Affected | n/a |
| Red Hat Openshift Data Foundation 4 | mcg | Not affected | n/a |
| Red Hat Satellite 6 | qpid-proton | Not affected | n/a |
| Red Hat Satellite 6 | satellite-capsule:el8/qpid-proton | Not affected | n/a |
| Red Hat Satellite 6 | satellite:el8/qpid-proton | Affected | n/a |
| Red Hat Satellite 6 | satellite:el8/yggdrasil-worker-forwarder | Affected | n/a |
| Red Hat Satellite 6 | yggdrasil | Affected | n/a |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | Affected | n/a |
| Red Hat Service Interconnect 1 | qpid-proton | Affected | n/a |
| Red Hat Service Interconnect 1 | skupper-cli | Not affected | n/a |
| Red Hat Service Interconnect 1 | skupper-router | Affected | n/a |
| Red Hat Storage 3 | heketi | Affected | n/a |
github.com/golang-fips/openssl
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/golang-fips/openssl | 0 | not fixed |
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat statement
This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (26)
- https://access.redhat.com/errata/RHSA-2024:10133 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7502 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7550 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8327 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8678 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8847 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:9551 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:2416 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:7118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:7256 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:7624 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:55520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:55525 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59439 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66016 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68504 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:69235 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-9355 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2315719 issue-trackingx_refsource_REDHATIssue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2916 Advisory
- https://github.com/advisories/GHSA-3h3x-2hwv-hr52 Advisory
- https://github.com/github/advisory-database/pull/4950
- https://github.com/golang-fips/openssl/pull/198
- https://nvd.nist.gov/vuln/detail/CVE-2024-9355
- https://pkg.go.dev/vuln/GO-2024-3167
- https://www.cve.org/CVERecord?id=CVE-2024-9355
Change history (0)
No recorded changes yet.