{"id":"GO-2024-3167","revision":"6b88c8e6a7564fc28c5ecbfd12410eb2","records":[{"revision":"6b88c8e6a7564fc28c5ecbfd12410eb2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2024-3167","aliases":["CVE-2024-9355","GHSA-3h3x-2hwv-hr52"],"title":"Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl","description":"A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.","state":0,"publishedAt":"2024-10-09T20:29:23+00:00","modifiedAt":"2026-03-03T04:55:50.086919+00:00","affected":[{"ecosystem":"Go","name":"github.com/golang-fips/openssl","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-3h3x-2hwv-hr52","https://github.com/golang-fips/openssl/pull/198","https://github.com/github/advisory-database/pull/4950"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-3167","license":"OSV · upstream source license applies","key":"osv:GO-2024-3167","identifiers":["GO-2024-3167","CVE-2024-9355","GHSA-3h3x-2hwv-hr52"]},"retained":false,"historicalAffected":[]}],"coverage":[]}