{"id":"CVE-2024-9355","aliases":["ALSA-2024:7502","ALSA-2024:7550","ALSA-2024:8327","ALSA-2024:8678","ALSA-2024:8847","ALSA-2025:7118","ALSA-2025:7256","ALSA-2026:66016","AZL-52774","BELL-CVE-2024-9355","CLSA-2025-1748626881","EUVD-2024-2916","GHSA-3h3x-2hwv-hr52","GO-2024-3167","OESA-2025-1052","OESA-2025-1053","OESA-2025-1054","OESA-2025-1055","OESA-2025-1056","OESA-2025-1124","OESA-2025-1167","RHSA-2024:10133","RHSA-2024:7502","RHSA-2024:7550","RHSA-2024:8327","RHSA-2024:8678","RHSA-2024:8847","RHSA-2024:9551","RHSA-2025:7118","RHSA-2025:7256","RHSA-2025:7624","RHSA-2026:55520","RHSA-2026:55525","RHSA-2026:66016","RHSA-2026:68504","RHSA-2026:69235","RLSA-2024:7502","RLSA-2024:7550","RLSA-2024:8327","RLSA-2024:8678","RLSA-2024:8847","RLSA-2025:7256","RLSA-2026:66016","SUSE-SU-2024:3911-1","openSUSE-SU-2024:0350-1","openSUSE-SU-2024:14447-1"],"status":"published","title":"Golang-fips: golang fips zeroed buffer","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00298,"percentile":0.22612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-457"],"published":"2024-10-01T05:56:38.9166Z","modified":"2026-11-05T13:17:06Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"delve","fixed_in":["1.21.2-4.module_el8.10.0+3895+92d465e0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"go-toolset","fixed_in":["1.21.13-1.module_el8.10.0+3895+92d465e0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang-bin","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang-docs","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang-misc","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang-src","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"golang-tests","fixed_in":["1.21.13-3.module_el8.10.0+3900+bb1e1982"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"go-toolset","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang-bin","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang-docs","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang-misc","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang-src","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"golang-tests","fixed_in":["1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"grafana-pcp","fixed_in":["5.1.1-9.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"golang","fixed_in":["1.22.9-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"etcd","fixed_in":["3.4.14-15.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"etcd","fixed_in":["3.4.14-15.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","fixed_in":["0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","fixed_in":["0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","fixed_in":["0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","fixed_in":["0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","fixed_in":["0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp","fixed_in":["0:5.1.1-9.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp-debuginfo","fixed_in":["0:5.1.1-9.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp-debugsource","fixed_in":["0:5.1.1-9.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp","fixed_in":["0:5.1.1-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp-debuginfo","fixed_in":["0:5.1.1-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp-debugsource","fixed_in":["0:5.1.1-4.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane","fixed_in":["0:0.23.0-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane-debuginfo","fixed_in":["0:0.23.0-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane-debugsource","fixed_in":["0:0.23.0-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane","fixed_in":["0:0.17.0-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane-debuginfo","fixed_in":["0:0.17.0-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane-debugsource","fixed_in":["0:0.17.0-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"delve","fixed_in":["0:1.21.2-4.module+el8.10.0+1868+7f5969f2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"golang","fixed_in":["0:1.21.13-3.module+el8.10.0+1873+81c21cb9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"go-toolset","fixed_in":["0:1.21.13-1.module+el8.10.0+1868+7f5969f2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"golang","fixed_in":["0:1.21.13-4.el9_4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"grafana-pcp","fixed_in":["0:5.1.1-9.el8_10"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/golang-fips/openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-4.module_el8.10.0+3895+92d465e0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-1.module_el8.10.0+3895+92d465e0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-3.module_el8.10.0+3900+bb1e1982"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"132-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"132-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"132-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-depsolve-dnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-luks2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-lvm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-osbuild","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141-1.el9.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-2.el8_10.alma.1"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-2.el8_10.alma.1"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-2.el8_10.alma.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.9-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13-1.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/golang-fips/openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/golang-fips/openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-10.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-13.oe2403"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5.oe2203sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-13.oe2403sp1"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5.oe2203sp3"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-15.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-15.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"rhc-worker-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10-2.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+22345+acdd8d0e"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-9.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-9.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-pcp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-9.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-pcp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-4.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_satellite_client:6::el10","package":"foreman_ygg_worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-1.el10sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_satellite_client:6::el8","package":"foreman_ygg_worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-1.el8sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_satellite_client:6::el9","package":"foreman_ygg_worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-1.el9sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_satellite_client:6::el8","package":"yggdrasil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.3-3.el8sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_satellite_client:6::el9","package":"yggdrasil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.3-3.el9sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"butane-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.17.0-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.17.0-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"butane-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.17.0-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-dnf-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-dnf-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-10.el8_8"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-dnf-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-dnf-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.3-8.el8_6"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-4.module+el8.10.0+1868+7f5969f2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-3.module+el8.10.0+1873+81c21cb9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-1.module+el8.10.0+1868+7f5969f2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.13-4.el9_4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-20.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-19.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-9.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-2.el8_10.rocky.0.6"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-5.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-1.1"}]}],"bundled":44}],"products":[{"vendor":"red hat","product":"nbde tang server"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift serverless"},{"vendor":"red hat","product":"red hat ansible automation platform 1.2"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container storage 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openshift on aws"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat service interconnect 1"},{"vendor":"red hat","product":"red hat storage 3"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"satellite client 6 for rhel 10"},{"vendor":"red hat","product":"satellite client 6 for rhel 8"},{"vendor":"red hat","product":"satellite client 6 for rhel 9"},{"vendor":"red hat","product":"streams for apache kafka 2.9.0"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10133","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7502","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7550","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8327","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8678","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8847","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9551","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2416","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7118","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7256","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7624","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55520","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55525","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59439","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66016","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68504","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69235","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90725","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90726","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92217","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-9355","tags":["vdb-entry","x_refsource_REDHAT","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2315719","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://github.com/golang-fips/openssl/pull/198","tags":["web","fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9355","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3167","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/4950","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3h3x-2hwv-hr52","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2315719","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-7502.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-7550.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318052","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-8327.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-8678.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-8847.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/2310529","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7118.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39321","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39322","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24788","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24790","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24791","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237777","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237778","tags":["report"]},{"url":"https://bugzilla.redhat.com/2279814","tags":["report"]},{"url":"https://bugzilla.redhat.com/2292787","tags":["report"]},{"url":"https://bugzilla.redhat.com/2295310","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7256.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45336","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2341751","tags":["report"]},{"url":"https://bugzilla.redhat.com/2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515840","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-66016.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-9355","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1748626881.html","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24791","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9676","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1054","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1055","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1056","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1124","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1167","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295310","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10133.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9355","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24791","tags":["advisory"]},{"url":"https://go.dev/cl/591255","tags":["article"]},{"url":"https://go.dev/issue/67555","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7502.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7550.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318052","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8327.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47875","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8678.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8847.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9551.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310529","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-16396","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-4570","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-4617","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-4636","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-56049","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-78659","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7118.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34158","tags":["advisory"]},{"url":"https://go.dev/cl/611240","tags":["article"]},{"url":"https://go.dev/issue/69141","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/S9POB9NCTdk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3107","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292787","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7256.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39321","tags":["advisory"]},{"url":"https://go.dev/cl/523039","tags":["article"]},{"url":"https://go.dev/issue/62266","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2044.json","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39322","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-2045.json","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24788","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2824","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24790","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2341751","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7624.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45336","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/70530","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55520.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55525.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66016.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68504.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22866","tags":["advisory"]},{"url":"https://go.dev/cl/643735","tags":["article"]},{"url":"https://go.dev/issue/71383","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3447","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://go.dev/cl/758320","tags":["article"]},{"url":"https://go.dev/issue/78282","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69235.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:7502","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:7550","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:8327","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:8678","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:8847","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7256","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66016","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243911-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8185","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-9355","title":"Golang-fips: golang fips zeroed buffer","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T18:17:29.42Z","modified":"2026-11-05T12:15:45.984Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-457"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-2916","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T18:17:29Z","modified":"2026-11-05T12:15:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-3h3x-2hwv-hr52","title":"Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T21:31:34Z","modified":"2026-09-21T18:31:44Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2024-9355","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T19:15:09.793Z","modified":"2026-11-05T13:17:06.343Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-457"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"BELL-CVE-2024-9355","title":"CVE-2024-9355 does not affect BellSoft software","status":"withdrawn","published":"2024-10-01T05:56:38.9166Z","modified":"2026-08-31T07:15:06.002053735Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"GHSA-3h3x-2hwv-hr52","title":"Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T21:31:34Z","modified":"2026-09-21T18:45:04.700597509Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"},{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"OESA-2025-1052","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:44.829476359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1053","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)\r\n\r\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)\r\n\r\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\r\n\r\nA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.(CVE-2024-9675)\r\n\r\nA vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.(CVE-2024-9676)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:44.98208219Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1054","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:44.986362122Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1055","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)\r\n\r\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)\r\n\r\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\r\n\r\nA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.(CVE-2024-9675)\r\n\r\nA vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.(CVE-2024-9676)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:45.210988845Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1056","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:18:44.927219581Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1124","title":"etcd security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)","status":"published","published":"2025-02-14T11:08:13Z","modified":"2026-08-18T01:18:46.898386172Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1167","title":"etcd security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)","status":"published","published":"2025-02-21T11:08:15Z","modified":"2026-08-18T01:18:47.582875235Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:10133","title":"Red Hat Security Advisory: rhc-worker-script security update","status":"published","published":"2024-11-25T09:50:56Z","modified":"2026-10-16T10:03:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:7502","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-10-22T17:00:41Z","modified":"2026-10-14T10:05:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:7550","title":"Red Hat Security Advisory: golang security update","status":"published","published":"2024-10-03T00:21:29Z","modified":"2026-10-14T10:05:15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8327","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2024-10-22T17:01:29Z","modified":"2026-10-14T10:05:27Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8678","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2024-10-30T22:50:05Z","modified":"2026-10-14T10:05:31Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8847","title":"Red Hat Security Advisory: grafana-pcp security update","status":"published","published":"2024-11-15T19:47:11Z","modified":"2026-10-14T10:05:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9551","title":"Red Hat Security Advisory: grafana-pcp security update","status":"published","published":"2024-11-21T21:57:19Z","modified":"2026-10-14T10:05:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:7118","title":"Red Hat Security Advisory: osbuild and osbuild-composer security update","status":"published","published":"2026-08-05T10:26:50Z","modified":"2026-10-17T10:06:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7256","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-05-14T10:06:02Z","modified":"2026-10-20T10:04:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7624","title":"Red Hat Security Advisory: Satellite 6 Client Bug Fix Update","status":"published","published":"2026-01-04T10:09:04Z","modified":"2026-10-17T10:07:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2026:55520","title":"Red Hat Security Advisory: butane security update","status":"published","published":"2026-08-18T10:21:01Z","modified":"2026-10-14T10:23:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55525","title":"Red Hat Security Advisory: butane security update","status":"published","published":"2026-08-18T10:21:01Z","modified":"2026-10-14T10:23:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:66016","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-10T10:17:09Z","modified":"2026-10-20T10:13:20Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68504","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-17T10:18:19Z","modified":"2026-10-20T10:14:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69235","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-22T10:19:50Z","modified":"2026-10-20T10:14:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2025:7256","title":"Moderate: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)\n\n* golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)\n\n* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)\n\n* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:29.337222Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2026:66016","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-10T06:01:40.202522Z","modified":"2026-09-10T06:30:04.660790544Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ALSA-2024:7502","title":"Moderate: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2026-10-29T11:02:22.141139611Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:7550","title":"Moderate: golang security update","description":"The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2026-10-29T11:32:10.855192439Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:8327","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-22T00:00:00Z","modified":"2026-10-29T11:02:27.929043161Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:8678","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n  * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-10-30T00:00:00Z","modified":"2026-10-29T11:31:50.985378447Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:8847","title":"Moderate: grafana-pcp security update","description":"The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.  \n\nSecurity Fix(es):  \n\n  * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-05T00:00:00Z","modified":"2026-10-29T11:02:21.952848997Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:7118","title":"Important: osbuild and osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)\n  * go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)\n  * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:06.204136755Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7256","title":"Moderate: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  \n\nSecurity Fix(es):  \n\n  * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)\n  * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)\n  * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)\n  * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)\n  * net/[http:](http:) Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n  * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.722775031Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2026:66016","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n  * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)\n  * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n  * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n  * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:02:29.210921312Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-52774","title":"CVE-2024-9355 affecting package golang for versions less than 1.22.9-1","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-01T19:15:09Z","modified":"2026-04-21T04:47:40.952893Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"CLSA-2025-1748626881","title":"golang: Fix of 2 CVEs","description":"- CVE-2024-24789: fix zip parsing to reject EOCDR records with truncated comments\n- CVE-2024-9355: fix HMAC to pass initialized length to EVP_DigestSignFinal,\n  ensuring correct output handling.","status":"published","published":"2025-05-30T17:41:25Z","modified":"2026-06-01T00:30:50.37142499Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"GO-2024-3167","title":"Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.","status":"published","published":"2024-10-09T20:29:23Z","modified":"2026-03-03T04:55:50.086919Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T14:52:20Z","modified":"2026-02-04T12:23:04.839834Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14447-1","title":"govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-01T00:00:00Z","modified":"2026-02-04T03:23:32.319637Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:7502","title":"Moderate: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-25T17:16:21.716473Z","modified":"2026-02-04T07:40:28.389248Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:7550","title":"Moderate: golang security update","description":"The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-25T17:17:26.358059Z","modified":"2026-02-04T22:30:05.671124Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:8327","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-25T17:16:21.716473Z","modified":"2026-02-05T06:00:07.483834Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:8678","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-08T15:57:59.128395Z","modified":"2026-02-05T03:15:11.95862Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:8847","title":"Moderate: grafana-pcp security update","description":"The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-08T15:56:47.559546Z","modified":"2026-02-04T11:30:10.341059Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:3911-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nUpdate to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T07:45:02Z","modified":"2026-02-05T08:02:05.10845Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}