CVE-2016-9123 Integer Overflow in go-jose
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| square github.com/square/go-jose(Go) | < 0.0.0-20160903044734-789a4c4bd4c1 | 0.0.0-20160903044734-789a4c4bd4c1 |
| debian/golang-gopkg-square-go-jose.v1(Debian:12) | < 1.0.5-1 | 1.0.5-1 |
| debian/golang-gopkg-square-go-jose.v1(Debian:13) | < 1.0.5-1 | 1.0.5-1 |
| debian/golang-gopkg-square-go-jose.v1(Debian:14) | < 1.0.5-1 | 1.0.5-1 |
| go-jose project go-jose | <= 1.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- hackerone.com permissions-required
- pkg.go.dev
- www.openwall.com
- Debian Security Tracker CVE-2016-9123 vendor-advisory
- www.openwall.com mailing-list patch third-party-advisory
- github.com