CVE-2016-9122

NONE EPSS 78.0%
Published Mar 28, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Mar 28, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Threat Intelligence

EPSS Exploit Probability
78.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-284

Affected Products 1

VendorProductVersionRange
go-jose_projectgo-jose* ≤1.0.3

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2016/11/03/1
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
    Issue TrackingPatchThird Party Advisory
  • hackerone.com https://hackerone.com/reports/169629
    Permissions Required

Remediation

  • openwall.com http://www.openwall.com/lists/oss-security/2016/11/03/1
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
    Issue TrackingPatchThird Party Advisory