PT-2017-9958 · Go · Go-Jose

Quan Nguyen · Publicado 2017-03-28 · Atualizado 2021-06-23 · CVE-2016-9121

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.0.4

Description The issue arises from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, the received public key on a message is not checked to be on the same curve as the static private key of the receiver. This allows an attacker to mount an invalid curve attack during decryption.

Recommendations For go-jose versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider validating the curve of the received public key against the receiver's private key curve before proceeding with the ECDH-ES algorithm. Restrict access to the ECDH-ES functionality until the update is applied to minimize the risk of exploitation.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2016-9121

GHSA-86R9-39J9-99WP

GO-2020-0010

Produtos afetados

Go-Jose

Referências · 11

• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9121 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9121 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2016/11/03/1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-9121 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/11/03/1 · Correção
• https://pkg.go.dev/vuln/GO-2020-0010 · Nota
• https://osv.dev/vulnerability/GHSA-86r9-39j9-99wp · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2020-0010 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9121 · Aviso do Fabricante
• https://hackerone.com/reports/164590 · Nota