VDB
RHSA-2026:68504
RHSA-2026:68504
PUBLISHED
CVSS 8.100000381469727 HIGH
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | osbuild-composer-worker-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-core-debuginfo-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-core-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-0:75-10.el8_8.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-debugsource-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-worker-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-tests-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-worker-debuginfo-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-tests-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-0:75-10.el8_8.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-debugsource-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-debuginfo-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | * |
| Red Hat | osbuild-composer-dnf-json-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-dnf-json-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-core-0:75-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-debugsource-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
| Red Hat | osbuild-composer-0:75-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | * |
…and 9 more
Timeline
- Sep 17, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:68504 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2315719 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456335 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515827 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515838 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
…and 120 more