Upstream information

CVE-2024-9355 at MITRE

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v3 Scores
	CNA (Red Hat)
Base Score	6.5
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack Vector	Local
Attack Complexity	High
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	Low
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

RHSA-2024:7502, published Thu Oct 3 15:05:56 UTC 2024
RHSA-2024:7550, published Thu Oct 3 15:05:56 UTC 2024
RHSA-2024:8327, published Wed Oct 23 15:05:57 UTC 2024

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 8	`delve >= 1.21.2-4.module+el8.10.0+22329+6cd5c9c6` `go-toolset >= 1.21.13-1.module+el8.10.0+22329+6cd5c9c6` `golang >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `golang-bin >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `golang-docs >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `golang-misc >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `golang-src >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `golang-tests >= 1.21.13-3.module+el8.10.0+22345+acdd8d0e` `grafana >= 9.2.10-20.el8_10` `grafana-selinux >= 9.2.10-20.el8_10`	Patchnames: RHSA-2024:7502 RHSA-2024:8327
SUSE Liberty Linux 9	`go-toolset >= 1.21.13-4.el9_4` `golang >= 1.21.13-4.el9_4` `golang-bin >= 1.21.13-4.el9_4` `golang-docs >= 1.21.13-4.el9_4` `golang-misc >= 1.21.13-4.el9_4` `golang-src >= 1.21.13-4.el9_4` `golang-tests >= 1.21.13-4.el9_4`	Patchnames: RHSA-2024:7550

SUSE Timeline for this CVE

CVE page created: Tue Oct 1 00:00:15 2024
CVE page last modified: Wed Oct 23 19:50:52 2024