Go/gopkg.in/square/go-jose.v1 CVE-2016-9122: high 7.5, EPSS 1.97%

Go JOSE Signature Validation Bypass

Action: Upgrade gopkg.in/square/go-jose.v1 to 1.1.0 or later.

go get gopkg.in/square/go-jose.v1@v1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-77gc-fj98-665h
• https://nvd.nist.gov/vuln/detail/CVE-2016-9122
• https://github.com/square/go-jose/pull/111
• https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
• https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96
• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507
• https://hackerone.com/reports/169629
• https://github.com/square/go-jose
• https://www.openwall.com/lists/oss-security/2016/11/03/1
• http://www.openwall.com/lists/oss-security/2016/11/03/1

CVE-2016-9122 · published 2021-05-18T19:15:09Z · modified 2024-05-20T21:20:33Z · JSON