CVE-2024-9355
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was found in Golang FIPS OpenSSL that allows a malicious user to return an uninitialized buffer length variable with a zeroed buffer in FIPS mode. This may lead to false positive hash comparisons and result in a derived key being all zeros.
Risk Assessment
This vulnerability could lead to hmac comparison fraud and impact the security of the Go TLS stack, posing a serious threat to data integrity.
Recommendation
It is recommended to update to the latest version of Golang FIPS OpenSSL to mitigate this vulnerability and to monitor systems for potential exploitation attempts.
Original NVD description (English source)
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.