This Red Hat security advisory addresses multiple vulnerabilities in the rhc client tool and daemon, which connects systems to Red Hat hosted services for system and subscription management. The update includes fixes for numerous issues primarily in Golang components such as crypto/tls, net/http, crypto/x509, and others. Vulnerabilities include denial of service, privilege escalation, incorrect certificate validation, cross-site scripting, and man-in-the-middle attack vectors. The advisory rates the overall security impact as Important and provides links to detailed CVE pages for each issue. The update targets Red Hat Enterprise Linux 8.8 variants.

Red Hat Security Advisory: rhc security update

This Red Hat security advisory addresses multiple vulnerabilities in the rhc client tool and daemon, which connects systems to Red Hat hosted services for system and subscription management. The update fixes a range of issues in underlying Golang components, including denial of service, privilege escalation, cross-site scripting, man-in-the-middle attacks, and incorrect certificate validation. These vulnerabilities affect various Golang packages used by rhc, impacting TLS, HTTP, MIME processing, and URL handling. The advisory rates the security impact as Important and provides fixes for Red Hat Enterprise Linux 8.6 Extended Life Cycle and AUS variants.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat issued an important security update for osbuild-composer, a service that builds customized OS artifacts and uploads images to cloud environments. The update addresses multiple vulnerabilities in underlying Golang components, including denial of service, privilege escalation, cross-site scripting, and sensitive data exposure issues. These vulnerabilities affect various Golang libraries such as net/http, net/mail, encoding/asn1, and crypto/tls. The advisory covers Red Hat Enterprise Linux 8 across multiple architectures and includes fixes for all listed CVEs.

The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21

Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

A moderate severity security vulnerability (CVE-2024-9355) affects the Butane tool used in Red Hat Enterprise Linux 9.2 for translating human-readable configs into Ignition configs. The issue involves a flaw in the golang-fips component related to zeroed buffer handling. Red Hat has released an update to address this vulnerability in Butane version 0.17.0-1.el9_2.1 for multiple architectures and variants of RHEL 9.2.

Red Hat Security Advisory: butane security update

A moderate severity security vulnerability (CVE-2024-9355) affects the butane tool used in Red Hat Enterprise Linux 9.6 Extended Update Support. The flaw involves a zeroed buffer issue in the golang-fips component. Butane translates human-readable configs into machine-readable Ignition configs for OS provisioning. A security update is available to address this issue.

Red Hat Security Advisory: Satellite 6 Client Bug Fix Update

Remote Host Configuration (rhc) worker for executing scripts on hosts managed by Red Hat Insights.

Security Fix(es):

* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: rhc-worker-script security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: grafana-pcp security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. 

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: grafana security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. 

Security Fix(es):

* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: go-toolset:rhel8 security update

openssl

CVE-2024-9355 is a vulnerability in the Golang FIPS OpenSSL library where an uninitialized buffer length variable can be returned as zero in FIPS mode. This flaw may cause false positive matches between non-equal HMAC sums and can result in derived keys being all zeros instead of unpredictable values, potentially impacting the Go TLS stack.

Search: CVE-2024-9355