PT-2017-9959 · Go · Go-Jose

Quan Nguyen · Publicado 2017-03-28 · Atualizado 2022-08-22 · CVE-2016-9122

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.1.0 go-jose versions prior to 1.0.4

Description The go-jose library is affected by an issue related to multiple signatures exploitation. When validating a signed message, the API does not indicate which signature is valid. This could lead to confusion, as users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Recommendations For go-jose versions prior to 1.0.4, update to version 1.0.4 or later. For go-jose versions prior to 1.1.0, update to version 1.1.0 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9122

GHSA-77GC-FJ98-665H

GO-2022-0945

Produtos afetados

Go-Jose

Referências · 14

• https://github.com/square/go-jose/pull/111 · Nota
• https://github.com/square/go-jose · Nota
• https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6 · Correção
• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 · Nota
• https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 · Nota
• http://openwall.com/lists/oss-security/2016/11/03/1 · Correção
• https://security-tracker.debian.org/tracker/CVE-2016-9122 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9122 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-77gc-fj98-665h · Aviso do Fabricante
• https://hackerone.com/reports/169629 · Nota
• https://osv.dev/vulnerability/GO-2022-0945 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2016/11/03/1 · Nota
• https://osv.dev/vulnerability/CVE-2016-9122 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9122 · Nota de Segurança