AZL-52774
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-52774.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-52774
- Upstream
- Published
- 2024-10-01T19:15:09Z
- Modified
- 2026-04-21T04:33:31.121405Z
- Summary
- CVE-2024-9355 affecting package golang for versions less than 1.22.9-1
- Details
-
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
- References