4 matches found
Elliptic Curve Key Disclosure in go-jose
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making ...
Elliptic Curve Key Disclosure
Affected versions of the package are vulnerable to Elliptic Curve Key Disclosure...
Security Bulletin: IBM Content Navigator is vulnerable to an Elliptic Curve Key Disclosure.
Summary IBM Content Navigator has addressed the following vulnerability. A potential vulnerability in the jose4j module could allow information disclosure. Vulnerability Details Third Party Entry: 186425 DESCRIPTION: jose.4.j library key information disclosure CVSS Base score: 8.7 CVSS Temporal...
