CVE-2016-9122

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

CVE-2016-9122

The vulnerability CVE-2016-9122 affects the go-jose library prior to 1.0.4. When validating a signed message that uses multiple signatures, the API did not indicate which signature was successfully validated, which could lead to confusion and the possibility of reading protected header values fro...