GitHub Advisoryadvisory · Go
GHSA-77gc-fj98-665h Go JOSE Signature Validation Bypass
HIGH
Official page ↗
- Aliases
- CVE-2016-9122
- Ecosystem
- Go
- Packages
- gopkg.in/square/go-jose.v1
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2021-05-12
Affected packages
• Go gopkg.in/square/go-jose.v1: < 1.1.0 → fixed in 1.1.0
Description
Go JOSE before 1.1.0 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated
Related
Alias · CVE (1)
- CVE-2016-9122 go-jose before 1.0.4 suffers from multiple signatures exploitation. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-9122 advisory
- https://github.com/square/go-jose/pull/111 web
- https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6 web
- https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 web
- https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 web
- https://hackerone.com/reports/169629 web
- https://github.com/square/go-jose package
- https://www.openwall.com/lists/oss-security/2016/11/03/1 web
- http://www.openwall.com/lists/oss-security/2016/11/03/1 web