PT-2017-9959 · Go · Go-Jose

Quan Nguyen · Published 2017-03-28 · Updated 2022-08-22 · CVE-2016-9122

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.1.0 go-jose versions prior to 1.0.4

Description The go-jose library is affected by an issue related to multiple signatures exploitation. When validating a signed message, the API does not indicate which signature is valid. This could lead to confusion, as users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Recommendations For go-jose versions prior to 1.0.4, update to version 1.0.4 or later. For go-jose versions prior to 1.1.0, update to version 1.1.0 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9122

GHSA-77GC-FJ98-665H

GO-2022-0945

Affected Products

Go-Jose

References · 14

• https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6 · Patch
• http://openwall.com/lists/oss-security/2016/11/03/1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-9122 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9122 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77gc-fj98-665h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0945 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9122 · Security Note
• https://github.com/square/go-jose/pull/111 · Note
• https://github.com/square/go-jose · Note
• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 · Note
• https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 · Note
• https://hackerone.com/reports/169629 · Note
• https://openwall.com/lists/oss-security/2016/11/03/1 · Note