Red Hat Security Advisory: Satellite 6 Client Bug Fix Update

Fixed packages 5

Vulnerabilities 2

• Medium 6.5
  CVE-2024-9355

  Golang-fips: golang fips zeroed buffer

  A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Oct 1, 2024
• Medium 6.1
  CVE-2024-45336

  Sensitive headers incorrectly sent after cross-domain redirect in net/http

  The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2341751
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7624.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9355
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9355
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9355
• article
  https://github.com/golang-fips/openssl/pull/198
• report
  https://access.redhat.com/security/cve/CVE-2024-45336
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45336
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45336
• article
  https://github.com/golang/go/issues/70530
• article
  https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI