Red Hat: CVE-2024-9355: golang-fips: Golang FIPS zeroed buffer (Multiple Advisories)
Description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Solution(s)
- redhat-upgrade-delve
- redhat-upgrade-delve-debuginfo
- redhat-upgrade-delve-debugsource
- redhat-upgrade-go-toolset
- redhat-upgrade-golang
- redhat-upgrade-golang-bin
- redhat-upgrade-golang-docs
- redhat-upgrade-golang-misc
- redhat-upgrade-golang-src
- redhat-upgrade-golang-tests
- redhat-upgrade-grafana
- redhat-upgrade-grafana-debuginfo
- redhat-upgrade-grafana-debugsource
- redhat-upgrade-grafana-pcp
- redhat-upgrade-grafana-pcp-debuginfo
- redhat-upgrade-grafana-pcp-debugsource
- redhat-upgrade-grafana-selinux
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center