Golang-fips: golang fips zeroed buffer
Impact
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Source excerpt · redhatWhat to do
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
·
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.10-2.el7_9 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|---|
| 8100020241001112709.a3795dee to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:9.2.10-20.el8_10 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:5.1.1-9.el8_10 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:101.5-2.el8_10 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:46.3-8.el8_6 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Other versions: affected
| Version / range | Source status |
|---|---|
| 1:0.2.1-14.el8_6.1 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:46.3-8.el8_6 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Other versions: affected
| Version / range | Source status |
|---|---|
| 1:0.2.1-14.el8_6.1 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:75-10.el8_8 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:75-10.el8_8 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:1.21.13-4.el9_4 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:9.2.10-19.el9_4 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:132-1.el9 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:3.6.1-1.el9 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.17.0-1.el9_2.1 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:5.1.1-4.el9_4 to before * | unaffected |
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.23.0-1.el9_6.1 to before * | unaffected |
Red Hat · Satellite Client 6 for RHEL 10
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.3.1-1.el10sat to before * | unaffected |
Red Hat · Satellite Client 6 for RHEL 8
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.3.1-1.el8sat to before * | unaffected |
Red Hat · Satellite Client 6 for RHEL 9
Other versions: affected
| Version / range | Source status |
|---|---|
| 0:0.3.1-1.el9sat to before * | unaffected |
Red Hat · Streams for Apache Kafka 2.9.0
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Trusted Artifact Signer 1.3
Other versions: affected
| Version / range | Source status |
|---|---|
| 1787305413 to before * | unaffected |
Red Hat · NBDE Tang Server
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · OpenShift Developer Tools and Services
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · OpenShift Developer Tools and Services
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · OpenShift Pipelines
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · OpenShift Serverless
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Ansible Automation Platform 1.2
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Ansible Automation Platform 1.2
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Ansible Automation Platform 2
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Ansible Automation Platform 2
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 10
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 7
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 7
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 8
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Enterprise Linux 9
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Container Platform 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Openshift Container Storage 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Openshift Data Foundation 4
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Dev Spaces
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift GitOps
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift on AWS
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenShift Virtualization 4
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 16.2
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 16.2
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 16.2
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 16.2
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 17.1
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 17.1
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 17.1
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat OpenStack Platform 17.1
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Satellite 6
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Service Interconnect 1
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Service Interconnect 1
Other versions: unaffected
| Version / range | Source status |
|---|
Red Hat · Red Hat Service Interconnect 1
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Storage 3
Other versions: affected
| Version / range | Source status |
|---|
Original source description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
References
- Source reference access.redhat.com/errata/RHSA-2024:10133
- Source reference access.redhat.com/errata/RHSA-2024:7502
- Source reference access.redhat.com/errata/RHSA-2024:7550
- Source reference access.redhat.com/errata/RHSA-2024:8327
- Source reference access.redhat.com/errata/RHSA-2024:8678
- Source reference access.redhat.com/errata/RHSA-2024:8847
- Source reference access.redhat.com/errata/RHSA-2024:9551
- Source reference access.redhat.com/errata/RHSA-2025:2416
- Source reference access.redhat.com/errata/RHSA-2025:7118
- Source reference access.redhat.com/errata/RHSA-2025:7256
- Source reference access.redhat.com/errata/RHSA-2025:7624
- Source reference access.redhat.com/errata/RHSA-2026:55520
- Source reference access.redhat.com/errata/RHSA-2026:55525
- Source reference access.redhat.com/errata/RHSA-2026:59439
- Source reference access.redhat.com/errata/RHSA-2026:66016
- Source reference access.redhat.com/errata/RHSA-2026:68504
- Source reference access.redhat.com/errata/RHSA-2026:69235
- Source reference access.redhat.com/errata/RHSA-2026:90725
- Security advisory access.redhat.com/security/cve/CVE-2024-9355
- Source reference bugzilla.redhat.com/show_bug.cgi
- Patch github.com/golang-fips/openssl/pull/198