Informazioni sul CVE-2024-9355

Golang-fips: golang fips zeroed buffer

CWE ID: CWE-457

Base Score (CVSS): N/A

CVE: CVE-2024-9355

Descrizione: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Vettore di attacco CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Punteggio CVSS

Il CVSS è un sistema di valutazione che misura la gravità di una vulnerabilità informatica considerando fattori come l’impatto potenziale, la probabilità di attacco e la facilità di esecuzione.

Punteggio Base (calcolato da AziendaSicura): 6.5 (Medium)

Riassunto: Accesso: Local, Privilegi: Low, Interazione utente: None, Confidenzialità: High, Integrità: High, Disponibilità: Low.

Dettaglio del Vettore

Metrica Valore Significato Descrizione
Attack Vector (AV) L Local L’attaccante deve avere accesso locale al sistema.
Attack Complexity (AC) H High L’attacco richiede condizioni particolari o avanzate.
Privileges Required (PR) L Low Richiede pochi privilegi.
User Interaction (UI) N None Non è richiesta interazione dell’utente.
Scope (S) U Unchanged Il raggio d’azione non cambia.
Confidentiality Impact (C) H High Grave impatto sulla riservatezza.
Integrity Impact (I) H High Grave impatto sull’integrità.
Availability Impact (A) L Low Interferenza limitata.

Riferimenti esterni

Prodotti interessati

  • Sconosciuto – Sconosciuto
  • Red Hat – Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat – Streams for Apache Kafka 2.9.0
  • Red Hat – NBDE Tang Server
  • Red Hat – OpenShift Developer Tools and Services
  • Red Hat – OpenShift Developer Tools and Services
  • Red Hat – OpenShift Pipelines
  • Red Hat – OpenShift Serverless
  • Red Hat – Red Hat Ansible Automation Platform 1.2
  • Red Hat – Red Hat Ansible Automation Platform 1.2
  • Red Hat – Red Hat Ansible Automation Platform 2
  • Red Hat – Red Hat Ansible Automation Platform 2
  • Red Hat – Red Hat Enterprise Linux 7
  • Red Hat – Red Hat Enterprise Linux 7
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 8
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat Enterprise Linux 9
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat OpenShift Container Platform 4
  • Red Hat – Red Hat Openshift Container Storage 4
  • Red Hat – Red Hat Openshift Data Foundation 4
  • Red Hat – Red Hat OpenShift Dev Spaces
  • Red Hat – Red Hat OpenShift GitOps
  • Red Hat – Red Hat OpenShift on AWS
  • Red Hat – Red Hat OpenShift Virtualization 4
  • Red Hat – Red Hat OpenStack Platform 16.2
  • Red Hat – Red Hat OpenStack Platform 16.2
  • Red Hat – Red Hat OpenStack Platform 16.2
  • Red Hat – Red Hat OpenStack Platform 16.2
  • Red Hat – Red Hat OpenStack Platform 17.1
  • Red Hat – Red Hat OpenStack Platform 17.1
  • Red Hat – Red Hat OpenStack Platform 17.1
  • Red Hat – Red Hat OpenStack Platform 17.1
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Satellite 6
  • Red Hat – Red Hat Service Interconnect 1
  • Red Hat – Red Hat Service Interconnect 1
  • Red Hat – Red Hat Service Interconnect 1
  • Red Hat – Red Hat Storage 3
  • Red Hat – Red Hat Trusted Artifact Signer

Relazioni con altri prodotti

Produttore:Red Hat
Prodotto: Red Hat Enterprise Linux 7
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Enterprise Linux 8
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Enterprise Linux 9
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenShift Container Platform 4
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Storage 3
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Ansible Automation Platform 1.2
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Ansible Automation Platform 2
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenStack Platform 16.2
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Satellite 6
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: OpenShift Serverless
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Openshift Data Foundation 4
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenShift Virtualization 4
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenStack Platform 17.1
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Enterprise Linux 7 Extended Lifecycle Support
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenShift GitOps
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Enterprise Linux 9.4 Extended Update Support
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Trusted Artifact Signer
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: OpenShift Pipelines
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenShift Dev Spaces
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: NBDE Tang Server
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: OpenShift Developer Tools and Services
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Openshift Container Storage 4
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat OpenShift on AWS
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Red Hat Service Interconnect 1
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Produttore:Red Hat
Prodotto: Streams for Apache Kafka 2.9.0
Anno: 2024
CWE: CWE-457
CVSS: 0.0

Ulteriori risorse disponibili