Veille CVE

Jeudi 22 octobre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Serverless » ✕
  1. CVE-2024-9355 6.5 Moyenne

    Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

    A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

  2. CVE-2024-3727 8.3 Élevée

    Red Hat OADP-1.3-RHEL-9 · Red Hat Advanced Cluster Security 4.4 · Red Hat Advanced Cluster Security 4.5 · Red Hat Enterprise Linux 8

    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.