GHSA-3h3x-2hwv-hr52: remove v2 version from affected versions list

[qmuntal]

I'm an owner of the github.com/golang-fips/openssl repo and also main contributor: https://github.com/golang-fips/openssl/graphs/contributors.

GHSA-3h3x-2hwv-hr52 has been unintentionally assigned to the v2 major version, when only v1 is affected.

This PR removed the v2 version from the affected versions list.

[darakian]

Hey @qmuntal 👋

Out of curiosity do you know where this issue was addressed in the code? I've looked around a little and basedthis comment from the redhat bug
https://bugzilla.redhat.com/show_bug.cgi?id=2315719

intermittently return a zeroed buffer from (*boringHMAC).Sum() in FIPS mode

I was looking for a change to boringHMAC, however searching for that string doesn't return anything. If you don't have a code change I can inspect are there any release notes from the project mentioning the fix?

[qmuntal]

Hey @qmuntal 👋

Out of curiosity do you know where this issue was addressed in the code? I've looked around a little and basedthis comment from the redhat bug https://bugzilla.redhat.com/show_bug.cgi?id=2315719

intermittently return a zeroed buffer from (*boringHMAC).Sum() in FIPS mode

I was looking for a change to boringHMAC, however searching for that string doesn't return anything. If you don't have a code change I can inspect are there any release notes from the project mentioning the fix?

The issue was fixed in this PR: golang-fips/openssl#198. The master branch is not tagged nor versioned, so there is no "fixed version" unfortunately.

[darakian]

Mmmm that's unfortunate. I take it that the relevant code for the change is simply not in the v2 branch? I guess v2 is a rewrite/re-arch/whatever? I'm not overly familiar with golang, but it looks like the func (h *boringHMAC) functions don't exist in the hmac.go file on the v2branch.

[qmuntal]

Yep, v2 is a complete rewrite. The vulnerability is in a C function that no longer exists.

[darakian]

Gotcha. Thanks for taking the time to walk me through the context. Let me get this going for you :)

[advisory-database]

Hi @qmuntal! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!