GitHub Advisory DatabaseGHSA-77GC-FJ98-665HGo JOSE Signature Validation Bypass
0.001 Low
EPSS
Percentile
48.2%
Go JOSE before 1.1.0 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated
| CPE | Name | Operator | Version |
|---|---|---|---|
| gopkg.in/square/go-jose.v1 | lt | 1.1.0 |
References
www.openwall.com/lists/oss-security/2016/11/03/1
github.com/advisories/GHSA-77gc-fj98-665h
github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96
github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507
github.com/square/go-jose/pull/111
hackerone.com/reports/169629
nvd.nist.gov/vuln/detail/CVE-2016-9122
www.openwall.com/lists/oss-security/2016/11/03/1
Related
