VDB
RHSA-2026:69235
RHSA-2026:69235
PUBLISHED
CVSS 8.100000381469727 HIGH
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | osbuild-composer-dnf-json-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-tests-debuginfo-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-tests-debuginfo-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-core-0:46.3-8.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-0:46.3-8.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-dnf-json-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-debuginfo-0:46.3-8.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-debugsource-0:46.3-8.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-tests-debuginfo-0:46.3-8.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-core-debuginfo-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-worker-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-worker-debuginfo-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-core-debuginfo-0:46.3-8.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-worker-debuginfo-0:46.3-8.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-debuginfo-0:46.3-8.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-dnf-json-0:46.3-8.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-debugsource-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-debuginfo-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
| Red Hat | osbuild-composer-core-debuginfo-0:46.3-8.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | 46.3-8.el8 |
…and 27 more
Timeline
- Sep 21, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:69235 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2315719 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456335 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515827 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515838 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515840 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69235.json advisory
…and 105 more