Debian/golang-gopkg-square-go-jose.v1: critical 9.1
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received pub
Action: Upgrade golang-gopkg-square-go-jose.v1 to 1.0.5-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.5-1 | - |
Fixed versions
| 1.0.5-1 |
Sources
published · modified · JSON