Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-9355

19
FAUCET Score

CVE-2024-9355 is a medium-severity vulnerability in Golang FIPS OpenSSL that allows for an uninitialized buffer length variable to be returned in FIPS mode, potentially leading to false positive hash matches or zeroed derived keys. This flaw has a CVSS score of 6.5, indicating a local attack vector with high impact on confidentiality and integrity, but high attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
All Versions ImpactedCPE match
cpe:2.3:a:redhat:openshift_serverless:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
Exploitability Score
1.0
Impact Score
5.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.30%
Probability of exploitation in next 30 days
EPSS Percentile
22.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0030 is in the 68th percentile among its peer group of 1,297 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (106)

microsoftpatch availablevia msrc
Product: cbl2 msft-golang 1.22.8-1 on CBL Mariner 2.0Fixed in: 1.22.10-1
microsoftpatch availablevia msrc
Product: azl3 golang 1.22.9-1 on Azure Linux 3.0Fixed in: 1.22.9-1
microsoftpatch availablevia msrc
Product: 17569-17084Fixed in: 1.22.9-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 1.23.3-2
microsoftpatch availablevia msrc
Product: 19995-17086Fixed in: 1.22.10-1
microsoftpatch availablevia msrc
Product: 19987-17084Fixed in: 1.23.3-2
microsoftpatch availablevia msrc
Product: 20002-17084Fixed in: 1.22.9-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 1.23.3-2
microsoftpatch availablevia msrc
Product: azl3 golang 1.23.1-1 on Azure Linux 3.0Fixed in: 1.23.3-2
microsoftpatch availablevia msrc
Product: azl3 golang 1.22.7-3 on Azure Linux 3.0Fixed in: 1.22.9-1
redhatpatch availablevia redhat_api
Product: Satellite Client 6 for RHEL 8Fixed in: foreman_ygg_worker-0:0.3.1-1.el8sat
View patch
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 2.9.0Fixed in: golang-github-danielqsj-kafka_exporter
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: rhc-worker-script-0:0.10-2.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: go-toolset:rhel8-8100020241001112709.a3795dee
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: grafana-0:9.2.10-20.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: grafana-pcp-0:5.1.1-9.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: golang-0:1.21.13-4.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: grafana-0:9.2.10-19.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Satellite Client 6 for RHEL 9Fixed in: foreman_ygg_worker-0:0.3.1-1.el9sat
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: osbuild-composer-0:132-1.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: git-lfs-0:3.6.1-1.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: grafana-pcp-0:5.1.1-4.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Satellite Client 6 for RHEL 10Fixed in: foreman_ygg_worker-0:0.3.1-1.el10sat
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Virtualization 4Fixed in: kubevirt
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: ignition
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: opentelemetry-collector
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: weldr-client
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: buildah
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: butane
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: conmon-rs
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: containernetworking-plugins
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: cri-tools
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: golang-github-prometheus-promu
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: ignition
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: lifecycle-agent-operator-bundle-container
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: microshift
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/bare-metal-event-relay-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/numaresources-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-aws-efs-csi-driver-container-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-gcp-filestore-csi-driver-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-secrets-store-csi-driver-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-sriov-network-metrics-exporter-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-sriov-rdma-cni-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-vertical-pod-autoscaler-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/rdma-cni-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/sriov-network-metrics-exporter-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/topology-aware-lifecycle-manager-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift-clients
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: ose-aws-ecr-image-credential-provider
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: ose-azure-acr-image-credential-provider
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: ose-gcp-gcr-image-credential-provider
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: podman
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: runc
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: skopeo
redhatno patchvia redhat_api
Product: Red Hat Openshift Container Storage 4Fixed in: mcg
redhatno patchvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: mcg
redhatno patchvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: etcd
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: golang-github-infrawatch-apputils
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: golang-qpid-apache
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: qpid-proton
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: etcd
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: golang-github-infrawatch-apputils
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: golang-qpid-apache
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: qpid-proton
redhatno patchvia redhat_api
Product: Red Hat Satellite 6Fixed in: satellite:el8/qpid-proton
redhatno patchvia redhat_api
Product: Red Hat Satellite 6Fixed in: satellite:el8/yggdrasil-worker-forwarder
redhatno patchvia redhat_api
Product: Red Hat Satellite 6Fixed in: yggdrasil
redhatno patchvia redhat_api
Product: Red Hat Service Interconnect 1Fixed in: qpid-proton
redhatno patchvia redhat_api
Product: Red Hat Service Interconnect 1Fixed in: skupper-cli
redhatno patchvia redhat_api
Product: Red Hat Service Interconnect 1Fixed in: skupper-router
redhatno patchvia redhat_api
Product: Red Hat Storage 3Fixed in: heketi
redhatno patchvia redhat_api
Product: Red Hat Trusted Artifact SignerFixed in: rhtas/fulcio-rhel9
redhatno patchvia redhat_api
Product: Red Hat Satellite 6Fixed in: yggdrasil-worker-forwarder
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 1.2Fixed in: openshift-clients
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-gateway-proxy
redhatno patchvia redhat_api
Product: NBDE Tang ServerFixed in: tang-operator-bundle-container
redhatno patchvia redhat_api
Product: OpenShift Developer Tools and ServicesFixed in: helm
redhatno patchvia redhat_api
Product: OpenShift Developer Tools and ServicesFixed in: odo
redhatno patchvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines-client
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 1.2Fixed in: helm
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: host-metering
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: skopeo
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/buildah
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/conmon
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/containernetworking-plugins
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/podman
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/runc
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/skopeo
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8/toolbox
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: git-lfs
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: osbuild-composer
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: rhc
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: weldr-client
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: buildah
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: butane
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: grafana-pcp
redhatend of lifevia redhat_api
Product: Red Hat OpenShift on AWSFixed in: rosa
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: skopeo
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: runc
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: podman
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: gvisor-tap-vsock
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: containernetworking-plugins
redhatend of lifevia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-clients
redhatend of lifevia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: receptor

Vendor Advisories (4)

microsoft2024-Dec/CVE-2024-9355

CVE-2024-9355

Dec 10, 2024
microsoft2024-Oct/CVE-2024-9355Moderate

Golang-fips: golang fips zeroed buffer

Oct 8, 2024
goGHSA-3h3x-2hwv-hr52high

Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability

Oct 1, 2024
redhatCVE-2024-9355Moderate

golang-fips: Golang FIPS zeroed buffer

Sep 30, 2024

References

access.redhat.com / errata/RHSA-2024:10133
access.redhat.com / errata/RHSA-2024:7502
access.redhat.com / errata/RHSA-2024:7550
access.redhat.com / errata/RHSA-2024:8327
access.redhat.com / errata/RHSA-2024:8678
access.redhat.com / errata/RHSA-2024:8847
access.redhat.com / errata/RHSA-2024:9551
access.redhat.com / errata/RHSA-2025:2416
access.redhat.com / errata/RHSA-2025:7118
access.redhat.com / errata/RHSA-2025:7256
access.redhat.com / errata/RHSA-2025:7624
access.redhat.com / security/cve/CVE-2024-9355
bugzilla.redhat.com / show_bug.cgi
github.com / golang-fips/openssl/pull/198