CVE-2016-9122GO-2022-0945GHSA-77GC-FJ98-665H
go-jose before 1.0.4 suffers from multiple signatures exploitation.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.1.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Go JOSE All versions before 1.0.4
Go JOSE All versions before 1.0.4
- gopkg.in/square/go-jose.v1Go
fixed in 1.1.0