DEBIAN-CVE-2016-9123

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures...

CVE-2016-9121

CVE-2016-9121 affects square/go-jose prior to version 1.0.4, where ECDH-ES shared-key derivation neglects to verify that the received public key lies on the same elliptic curve as the receiver’s private key. This enables an invalid-curve attack during decryption and is stated across multiple sour...

CVE-2016-9123

The CVE-2016-9123 entry concerns go-jose and its CBC-HMAC implementation. Multiple connected sources confirm a CBC-HMAC integer overflow on 32-bit architectures in go-jose prior to 1.0.5, which could lead to authentication bypass for CBC-HMAC encrypted ciphertexts. Documents consistently describe...

CVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making ...

CVE-2016-9122

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

CVE-2016-9123

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures...

CVE-2016-9122

The vulnerability CVE-2016-9122 affects the go-jose library prior to 1.0.4. When validating a signed message that uses multiple signatures, the API did not indicate which signature was successfully validated, which could lead to confusion and the possibility of reading protected header values fro...

CVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making ...

CVE-2016-9122

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

CVE-2016-9123

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures...

PT-2017-9959 · Go · Go-Jose

Name of the Vulnerable Software and Affected Versions: go-jose versions prior to 1.1.0 go-jose versions prior to 1.0.4 Description: The go-jose library is affected by an issue related to multiple signatures exploitation. When validating a signed message, the API does not indicate which signature ...