# CVE-2024-9355

## Summary

- **CVE ID:** CVE-2024-9355
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
- **CWE:** CWE-457
- **Published:** Oct 1, 2024
- **Last Modified:** Sep 17, 2026

## Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

## Affected Products

- Red Hat — Red Hat Enterprise Linux 7 Extended Lifecycle Support (0:0.10-2.el7_9)
- Red Hat — Red Hat Enterprise Linux 8 (8100020241001112709.a3795dee)
- Red Hat — Red Hat Enterprise Linux 8 (0:9.2.10-20.el8_10)
- Red Hat — Red Hat Enterprise Linux 8 (0:5.1.1-9.el8_10)
- Red Hat — Red Hat Enterprise Linux 9 (0:1.21.13-4.el9_4)
- Red Hat — Red Hat Enterprise Linux 9 (0:9.2.10-19.el9_4)
- Red Hat — Red Hat Enterprise Linux 9 (0:132-1.el9)
- Red Hat — Red Hat Enterprise Linux 9 (0:3.6.1-1.el9)
- Red Hat — Red Hat Enterprise Linux 9.4 Extended Update Support (0:5.1.1-4.el9_4)
- Red Hat — Satellite Client 6 for RHEL 10 (0:0.3.1-1.el10sat)
- Red Hat — Satellite Client 6 for RHEL 8 (0:0.3.1-1.el8sat)
- Red Hat — Satellite Client 6 for RHEL 9 (0:0.3.1-1.el9sat)
- Red Hat — Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (0:0.17.0-1.el9_2.1)
- Red Hat — Red Hat Enterprise Linux 9.6 Extended Update Support (0:0.23.0-1.el9_6.1)
- Red Hat — Red Hat Trusted Artifact Signer 1.3 (1787305413)
- Red Hat — Red Hat Enterprise Linux 8 (0:101.5-2.el8_10)
- Red Hat — Red Hat Enterprise Linux 8.8 Telecommunications Update Service (0:75-10.el8_8)
- Red Hat — Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (0:75-10.el8_8)

## References

- [CNA](https://access.redhat.com/errata/RHSA-2024:10133)
- [CNA](https://access.redhat.com/errata/RHSA-2024:7502)
- [CNA](https://access.redhat.com/errata/RHSA-2024:7550)
- [CNA](https://access.redhat.com/errata/RHSA-2024:8327)
- [CNA](https://access.redhat.com/errata/RHSA-2024:8678)
- [CNA](https://access.redhat.com/errata/RHSA-2024:8847)
- [CNA](https://access.redhat.com/errata/RHSA-2024:9551)
- [CNA](https://access.redhat.com/errata/RHSA-2025:2416)
- [CNA](https://access.redhat.com/errata/RHSA-2025:7118)
- [CNA](https://access.redhat.com/errata/RHSA-2025:7256)
- [CNA](https://access.redhat.com/errata/RHSA-2025:7624)
- [CNA](https://access.redhat.com/security/cve/CVE-2024-9355)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2315719)
- [CNA](https://github.com/golang-fips/openssl/pull/198)
- [CNA](https://access.redhat.com/errata/RHSA-2026:55520)
- [CNA](https://access.redhat.com/errata/RHSA-2026:55525)
- [CNA](https://access.redhat.com/errata/RHSA-2026:59439)
- [CNA](https://access.redhat.com/errata/RHSA-2026:66016)
- [CNA](https://access.redhat.com/errata/RHSA-2026:68504)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.30%
- **EPSS Percentile:** 22.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._