Alma Linux: CVE-2024-9355: Moderate: go-toolset:rhel8 security update (Multiple Advisories)
Description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Solution(s)
- alma-upgrade-delve
- alma-upgrade-go-toolset
- alma-upgrade-golang
- alma-upgrade-golang-bin
- alma-upgrade-golang-docs
- alma-upgrade-golang-misc
- alma-upgrade-golang-src
- alma-upgrade-golang-tests
- alma-upgrade-grafana
- alma-upgrade-grafana-pcp
- alma-upgrade-grafana-selinux
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center