GitHub Advisoryadvisory · Go

GHSA-3fx4-7f69-5mmg Integer Overflow in go-jose

HIGH Published 2021-06-23 Modified 2026-07-06 Official page ↗
Aliases
CVE-2016-9123
Ecosystem
Go
Packages
github.com/square/go-jose
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-190
Reviewed
2021-05-20

Affected packages

• Go github.com/square/go-jose: < 0.0.0-20160903044734-789a4c4bd4c1 → fixed in 0.0.0-20160903044734-789a4c4bd4c1

Description

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

Related

Alias · CVE (1)

  • CVE-2016-9123 go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References