目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

CVE-2024-9355— Google Golang 安全漏洞

CVSS 6.5 · Medium EPSS 0.30% · P22

Possible ATT&CK Techniques 1AI

T1552.003 · Shell History

Affected Version Matrix 126

ベンダープロダクトVersion Rangeステータス
NoneNoneanyaffected
Red HatNBDE Tang Serveranyaffected
Red HatOpenShift Developer Tools and Servicesanyaffected
anyaffected
Red HatOpenShift Pipelinesanyaffected
Red HatOpenShift Serverlessanyaffected
Red HatRed Hat Ansible Automation Platform 1.2anyaffected
anyaffected
Red HatRed Hat Ansible Automation Platform 2anyunaffected
anyaffected
Red HatRed Hat Enterprise Linux 10anyunaffected
anyunaffected
anyunaffected
anyunaffected
anyunaffected
anyunaffected
anyunaffected
anyunaffected
… +10 more rows
Red HatRed Hat Enterprise Linux 7anyaffected
anyaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:0.10-2.el7_9< *unaffected
Red HatRed Hat Enterprise Linux 88100020241001112709.a3795dee< *unaffected
0:9.2.10-20.el8_10< *unaffected
0:5.1.1-9.el8_10< *unaffected
anyaffected
anyunaffected
anyaffected
anyaffected
anyaffected
… +7 more rows
Red HatRed Hat Enterprise Linux 90:1.21.13-4.el9_4< *unaffected
0:9.2.10-19.el9_4< *unaffected
0:132-1.el9< *unaffected
0:3.6.1-1.el9< *unaffected
anyaffected
anyaffected
anyunaffected
anyaffected
… +10 more rows
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:0.17.0-1.el9_2.1< *unaffected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support0:5.1.1-4.el9_4< *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:0.23.0-1.el9_6.1< *unaffected
Red HatRed Hat OpenShift Container Platform 4anyaffected
anyaffected
anyunaffected
anyunaffected
anyaffected
anyunaffected
anyunaffected
anyunaffected
… +22 more rows
Red HatRed Hat Openshift Container Storage 4anyaffected
Red HatRed Hat Openshift Data Foundation 4anyunaffected
Red HatRed Hat OpenShift Dev Spacesanyunaffected
Red HatRed Hat OpenShift GitOpsanyaffected
Red HatRed Hat OpenShift on AWSanyaffected
Red HatRed Hat OpenShift Virtualization 4anyaffected
Red HatRed Hat OpenStack Platform 16.2anyaffected
anyunaffected
anyunaffected
anyunaffected
Red HatRed Hat OpenStack Platform 17.1anyaffected
anyunaffected
anyunaffected
anyunaffected
Red HatRed Hat Satellite 6anyunaffected
anyunaffected
anyaffected
anyaffected
anyaffected
anyaffected
Red HatRed Hat Service Interconnect 1anyaffected
anyunaffected
anyaffected
Red HatRed Hat Storage 3anyaffected
Red HatRed Hat Trusted Artifact Signeranyaffected
Red HatSatellite Client 6 for RHEL 100:0.3.1-1.el10sat< *unaffected
Red HatSatellite Client 6 for RHEL 80:0.3.1-1.el8sat< *unaffected
Red HatSatellite Client 6 for RHEL 90:0.3.1-1.el9sat< *unaffected
Red HatStreams for Apache Kafka 2.9.0anyunaffected

I. CVE-2024-9355の基本情報

脆弱性情報

脆弱性についてご質問がありますか?Shenlongの分析が参考になるかご確認ください!
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
Golang-fips: golang fips zeroed buffer
ソース: CVE Program / CVE List V5
脆弱性説明
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
ソース: CVE Program / CVE List V5
脆弱性タイプ
使用未经初始化的变量
ソース: CVE Program / CVE List V5
脆弱性タイトル
Google Golang 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Google Golang是美国谷歌(Google)公司的一种静态强类型、编译型语言。Go的语法接近C语言,但对于变量的声明有所不同。Go支持垃圾回收功能。Go的并行模型是以东尼·霍尔的通信顺序进程(CSP)为基础,采取类似模型的其他语言包括Occam和Limbo,但它也具有Pi运算的特征,比如通道传输。在1.8版本中开放插件(Plugin)的支持,这意味着现在能从Go中动态加载部分函数。 Google Golang存在安全漏洞,该漏洞源于允许恶意用户在FIPS模式下随机导致未初始化的缓冲区长度变量与零缓
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
----
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.10-2.el7_9 ~ * cpe:/o:redhat:rhel_els:7
Red HatRed Hat Enterprise Linux 8 8100020241001112709.a3795dee ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red HatRed Hat Enterprise Linux 8 0:9.2.10-20.el8_10 ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red HatRed Hat Enterprise Linux 8 0:5.1.1-9.el8_10 ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red HatRed Hat Enterprise Linux 9 0:1.21.13-4.el9_4 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9 0:9.2.10-19.el9_4 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9 0:132-1.el9 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9 0:3.6.1-1.el9 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:0.17.0-1.el9_2.1 ~ * cpe:/a:redhat:rhel_e4s:9.2::appstream
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support 0:5.1.1-4.el9_4 ~ * cpe:/a:redhat:rhel_eus:9.4::appstream
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support 0:0.23.0-1.el9_6.1 ~ * cpe:/a:redhat:rhel_eus:9.6::appstream
Red HatSatellite Client 6 for RHEL 10 0:0.3.1-1.el10sat ~ * cpe:/a:redhat:rhel_satellite_client:6::el10
Red HatSatellite Client 6 for RHEL 8 0:0.3.1-1.el8sat ~ * cpe:/a:redhat:rhel_satellite_client:6::el10
Red HatSatellite Client 6 for RHEL 9 0:0.3.1-1.el9sat ~ * cpe:/a:redhat:rhel_satellite_client:6::el10
Red HatStreams for Apache Kafka 2.9.0-cpe:/a:redhat:amq_streams:2
Red HatNBDE Tang Server-cpe:/a:redhat:network_bound_disk_encryption_tang:1
Red HatOpenShift Developer Tools and Services-cpe:/a:redhat:ocp_tools
Red HatOpenShift Developer Tools and Services-cpe:/a:redhat:ocp_tools
Red HatOpenShift Pipelines-cpe:/a:redhat:openshift_pipelines:1
Red HatOpenShift Serverless-cpe:/a:redhat:serverless:1
Red HatRed Hat Ansible Automation Platform 1.2-cpe:/a:redhat:ansible_automation_platform
Red HatRed Hat Ansible Automation Platform 1.2-cpe:/a:redhat:ansible_automation_platform
Red HatRed Hat Ansible Automation Platform 2-cpe:/a:redhat:ansible_automation_platform:2
Red HatRed Hat Ansible Automation Platform 2-cpe:/a:redhat:ansible_automation_platform:2
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 7-cpe:/o:redhat:enterprise_linux:7
Red HatRed Hat Enterprise Linux 7-cpe:/o:redhat:enterprise_linux:7
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat OpenShift Container Platform 4-cpe:/a:redhat:openshift:4
Red HatRed Hat Openshift Container Storage 4-cpe:/a:redhat:openshift_container_storage:4
Red HatRed Hat Openshift Data Foundation 4-cpe:/a:redhat:openshift_data_foundation:4
Red HatRed Hat OpenShift Dev Spaces-cpe:/a:redhat:openshift_devspaces:3
Red HatRed Hat OpenShift GitOps-cpe:/a:redhat:openshift_gitops:1
Red HatRed Hat OpenShift on AWS-cpe:/a:redhat:openshift_service_on_aws:1
Red HatRed Hat OpenShift Virtualization 4-cpe:/a:redhat:container_native_virtualization:4
Red HatRed Hat OpenStack Platform 16.2-cpe:/a:redhat:openstack:16.2
Red HatRed Hat OpenStack Platform 16.2-cpe:/a:redhat:openstack:16.2
Red HatRed Hat OpenStack Platform 16.2-cpe:/a:redhat:openstack:16.2
Red HatRed Hat OpenStack Platform 16.2-cpe:/a:redhat:openstack:16.2
Red HatRed Hat OpenStack Platform 17.1-cpe:/a:redhat:openstack:17.1
Red HatRed Hat OpenStack Platform 17.1-cpe:/a:redhat:openstack:17.1
Red HatRed Hat OpenStack Platform 17.1-cpe:/a:redhat:openstack:17.1
Red HatRed Hat OpenStack Platform 17.1-cpe:/a:redhat:openstack:17.1
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Satellite 6-cpe:/a:redhat:satellite:6
Red HatRed Hat Service Interconnect 1-cpe:/a:redhat:service_interconnect:1
Red HatRed Hat Service Interconnect 1-cpe:/a:redhat:service_interconnect:1
Red HatRed Hat Service Interconnect 1-cpe:/a:redhat:service_interconnect:1
Red HatRed Hat Storage 3-cpe:/a:redhat:storage:3
Red HatRed Hat Trusted Artifact Signer-cpe:/a:redhat:trusted_artifact_signer:1

II. CVE-2024-9355の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2024-9355のインテリジェンス情報

登录查看更多情报信息。

CVE-2024-9355 补丁与修复 (1)

CVE-2024-9355 厂商安全公告 (11)

IV. 関連脆弱性

V. CVE-2024-9355へのコメント

まだコメントはありません


コメントを残す