<p>There is no fixed version for <code>Centos:9</code> <code>osbuild-composer-worker</code>.</p>

Use of Uninitialized Variable Affecting osbuild-composer-worker package, versions *

Threat Intelligence

0.04% (12^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS9-OSBUILDCOMPOSERWORKER-8137202
published 1 Oct 2024
disclosed 30 Sep 2024

Report a new vulnerability Found a mistake?

Introduced: 30 Sep 2024

CVE-2024-9355 Open this link in a new tab CWE-457 Open this link in a new tab

How to fix?

There is no fixed version for Centos:9 osbuild-composer-worker.

NVD Description

Note: Versions mentioned in the description apply only to the upstream osbuild-composer-worker package and not the osbuild-composer-worker package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Local
Attack Complexity (AC)

High
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

Low