Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-9355

Oct. 30, 2024, 11:15 p.m.

CVSS Score

6.5 / 10

Product(s) Impacted

UNKNOWN

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Weaknesses

CWE-457
Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

CWE ID: 457

Date

Published: Oct. 1, 2024, 7:15 p.m.

Last Modified: Oct. 30, 2024, 11:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

Base Score
6.5
Exploitability Score
1.0
Impact Score
5.5
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://access.redhat.com/ secalert@redhat.com

https://access.redhat.com/ secalert@redhat.com

https://access.redhat.com/ secalert@redhat.com

https://access.redhat.com/ secalert@redhat.com

https://access.redhat.com/ secalert@redhat.com

https://bugzilla.redhat.com/ secalert@redhat.com