Golang-fips: golang fips zeroed buffer

Summary

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Timeline

1. Oct 1, 2024, 6:17 PM UTCCVE published
2. Oct 1, 2024, 6:35 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 29, 2026, 5:19 AM UTCRecord last updated

Affected versions

• github.com/golang-fips/openssl

  Version range not reported

• rhc-worker-script

  Version range not reported

• go-toolset:rhel8

  Version range not reported

• grafana

  Version range not reported

• grafana-pcp

  Version range not reported

• osbuild-composer

  Version range not reported

• osbuild-composer

  Version range not reported

• rhc

  Version range not reported

• osbuild-composer

  Version range not reported

• rhc

  Version range not reported

• osbuild-composer

  Version range not reported

• rhc

  Version range not reported

• osbuild-composer

  Version range not reported

• rhc

  Version range not reported

• golang

  Version range not reported

• grafana

  Version range not reported

• osbuild-composer

  Version range not reported

• git-lfs

  Version range not reported

• butane

  Version range not reported

• grafana-pcp

  Version range not reported

• butane

  Version range not reported

• foreman_ygg_worker

  Version range not reported

• foreman_ygg_worker

  Version range not reported

• foreman_ygg_worker

  Version range not reported

• golang-github-danielqsj-kafka_exporter

  Version range not reported

• rhtas/fulcio-rhel9

  Version range not reported

• tang-operator-bundle-container

  Version range not reported

• helm

  Version range not reported

• odo

  Version range not reported

• openshift-pipelines-client

  Version range not reported

• openshift-serverless-clients

  Version range not reported

• helm

  Version range not reported

• openshift-clients

  Version range not reported

• automation-gateway-proxy

  Version range not reported

• receptor

  Version range not reported

• buildah

  Version range not reported

• butane

  Version range not reported

• conmon

  Version range not reported

• containers-common

  Version range not reported

• delve

  Version range not reported

• git-lfs

  Version range not reported

• golang-github-openprinting-ipp-usb

  Version range not reported

• grafana

  Version range not reported

• grafana-pcp

  Version range not reported

• gvisor-tap-vsock

  Version range not reported

• ignition

  Version range not reported

• osbuild-composer

  Version range not reported

• podman

  Version range not reported

• rsyslog

  Version range not reported

• skopeo

  Version range not reported

• toolbox

  Version range not reported

• yggdrasil

  Version range not reported

• yggdrasil-worker-package-manager

  Version range not reported

• host-metering

  Version range not reported

• skopeo

  Version range not reported

• container-tools:rhel8/buildah

  Version range not reported

• container-tools:rhel8/conmon

  Version range not reported

• container-tools:rhel8/containernetworking-plugins

  Version range not reported

• container-tools:rhel8/podman

  Version range not reported

• container-tools:rhel8/runc

  Version range not reported

• container-tools:rhel8/skopeo

  Version range not reported

• container-tools:rhel8/toolbox

  Version range not reported

• git-lfs

  Version range not reported

• rhc

  Version range not reported

• rsyslog

  Version range not reported

• weldr-client

  Version range not reported

• buildah

  Version range not reported

• butane

  Version range not reported

• conmon

  Version range not reported

• containernetworking-plugins

  Version range not reported

• grafana-pcp

  Version range not reported

• gvisor-tap-vsock

  Version range not reported

• ignition

  Version range not reported

• opentelemetry-collector

  Version range not reported

• podman

  Version range not reported

• rsyslog

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• toolbox

  Version range not reported

• weldr-client

  Version range not reported

• buildah

  Version range not reported

• butane

  Version range not reported

• conmon

  Version range not reported

• conmon-rs

  Version range not reported

• containernetworking-plugins

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• golang-github-prometheus-promu

  Version range not reported

• ignition

  Version range not reported

• lifecycle-agent-operator-bundle-container

  Version range not reported

• microshift

  Version range not reported

• openshift

  Version range not reported

• openshift4/bare-metal-event-relay-operator-bundle

  Version range not reported

• openshift4/numaresources-operator-bundle

  Version range not reported

• openshift4/ose-aws-efs-csi-driver-container-rhel8

  Version range not reported

• openshift4/ose-gcp-filestore-csi-driver-rhel8

  Version range not reported

• openshift4/ose-secrets-store-csi-driver-rhel9

  Version range not reported

• openshift4/ose-sriov-network-metrics-exporter-rhel9

  Version range not reported

• openshift4/ose-sriov-rdma-cni-rhel9

  Version range not reported

• openshift4/ose-vertical-pod-autoscaler-rhel8

  Version range not reported

• openshift4/sriov-network-metrics-exporter-rhel9

  Version range not reported

• openshift4/topology-aware-lifecycle-manager-operator-bundle

  Version range not reported

• openshift-clients

  Version range not reported

• ose-aws-ecr-image-credential-provider

  Version range not reported

• ose-azure-acr-image-credential-provider

  Version range not reported

• ose-gcp-gcr-image-credential-provider

  Version range not reported

• podman

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• mcg

  Version range not reported

• mcg

  Version range not reported

• devspaces/machineexec-rhel8

  Version range not reported

• openshift-gitops-1/gitops-operator-bundle

  Version range not reported

• rosa

  Version range not reported

• kubevirt

  Version range not reported

• etcd

  Version range not reported

• golang-github-infrawatch-apputils

  Version range not reported

• golang-qpid-apache

  Version range not reported

• qpid-proton

  Version range not reported

• etcd

  Version range not reported

• golang-github-infrawatch-apputils

  Version range not reported

• golang-qpid-apache

  Version range not reported

• qpid-proton

  Version range not reported

• qpid-proton

  Version range not reported

• satellite-capsule:el8/qpid-proton

  Version range not reported

• satellite:el8/qpid-proton

  Version range not reported

• satellite:el8/yggdrasil-worker-forwarder

  Version range not reported

• yggdrasil

  Version range not reported

• yggdrasil-worker-forwarder

  Version range not reported

• qpid-proton

  Version range not reported

• skupper-cli

  Version range not reported

• skupper-router

  Version range not reported

• heketi

  Version range not reported

• github.com/golang-fips/opensslGo

  through 2.0.3

• github.com/golang-fips/opensslGo

  All versions

References 22