PT-2017-9960 · Go · Go-Jose

Quan Nguyen · Publicado 2017-03-28 · Atualizado 2021-06-23 · CVE-2016-9123

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.0.5

Description The issue concerns an integer overflow in CBC-HMAC on 32-bit architectures, potentially leading to authentication bypass for CBC-HMAC encrypted ciphertexts. On 32-bit platforms, an attacker can manipulate ciphertext encrypted with AES-CBC with HMAC, allowing control over the input buffer size when computing the HMAC authentication tag. This could enable a manipulated ciphertext to be verified as authentic, making it vulnerable to padding oracle attacks.

Recommendations For go-jose versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of CBC-HMAC encryption on 32-bit architectures until the update is applied.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2016-9123

GHSA-3FX4-7F69-5MMG

GO-2020-0009

Produtos afetados

Go-Jose

Referências · 11

• https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9123 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-9123 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2020-0009 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3fx4-7f69-5mmg · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2016/11/03/1 · Nota
• http://openwall.com/lists/oss-security/2016/11/03/1 · Correção
• https://hackerone.com/reports/165170 · Nota
• https://pkg.go.dev/vuln/GO-2020-0009 · Nota
• https://osv.dev/vulnerability/CVE-2016-9123 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9123 · Aviso do Fabricante