CVE-2024-9355

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended…

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended…

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)

%{expand:

Security Fix(es):

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)

%{expand:

Security Fix(es):

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

• golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

• net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

• golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

• encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

• net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

• net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

• html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

• crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

• encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
• dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
• dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
• golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
• net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
• golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
• encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
• encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

• CVE-2024-24789: fix zip parsing to reject EOCDR records with truncated comments
• CVE-2024-9355: fix HMAC to pass initialized length to EVP_DigestSignFinal, ensuring correct output handling.

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
  • GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
  • GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
  • GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
  • GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
  • GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
  • GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
  • GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
  • GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

• Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
  • GO-2024-3245 CVE-2024-39720
  • GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

• Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
  • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

• Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
  • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
  • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

• Packaging improvments:

  • Backfill CVE aliases in recent changelog entries

• Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
  • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
  • GO-2024-3210 CVE-2024-8901
  • GO-2024-3211 CVE-2024-50312
  • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
  • GO-2024-3213 CVE-2024-49380
  • GO-2024-3214 CVE-2024-49381
  • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
  • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
  • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
  • GO-2024-3219 GHSA-7h65-4p22-39j6
  • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
  • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
  • GO-2024-3222 GHSA-x7xj-jvwp-97rv
  • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
  • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

• Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3203 CVE-2024-9486
  • GO-2024-3204 CVE-2024-9594

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
  • GO-2024-3199 GHSA-vv6c-69r6-chg9
  • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
  • GO-2024-3201 CVE-2023-22644 Go CVE Numbering Authority IDs added or updated with aliases:
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 Go CVE Numbering Authority IDs added or updated with aliases:
  • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
  • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
  • GO-2024-3163 CVE-2024-47182
  • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
  • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
  • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
  • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
  • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
  • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
  • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
  • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
  • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
  • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
  • GO-2024-3182 GHSA-wpr2-j6gr-pjw9 *…

These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

• dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

• dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
  • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
  • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
  • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
  • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
  • GO-2024-3210 CVE-2024-8901
  • GO-2024-3211 CVE-2024-50312
  • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
  • GO-2024-3213 CVE-2024-49380
  • GO-2024-3214 CVE-2024-49381
  • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
  • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
  • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
  • GO-2024-3219 GHSA-7h65-4p22-39j6
  • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
  • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
  • GO-2024-3222 GHSA-x7xj-jvwp-97rv
  • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
  • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3203 CVE-2024-9486
  • GO-2024-3204 CVE-2024-9594

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
  • GO-2024-3199 GHSA-vv6c-69r6-chg9
  • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
  • GO-2024-3201 CVE-2023-22644

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
  • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
  • GO-2024-3163 CVE-2024-47182
  • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
  • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
  • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
  • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
  • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
  • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
  • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
  • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
  • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
  • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
  • GO-2024-3182 GHSA-wpr2-j6gr-pjw9
  • GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m
  • GO-2024-3185 CVE-2024-47832
  • GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp
  • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
  • GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226
  • GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j