{"action":"Upgrade gopkg.in/square/go-jose.v1 to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"gopkg.in/square/go-jose.v1","cve_ids":["CVE-2016-9122"],"ecosystem":"Go","epss":0.01969,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-77gc-fj98-665h","id":"tcs_01M5KF1J8RQSMH8C3GGDXRCD5P","modified_at":"2024-05-20T21:20:33Z","published_at":"2021-05-18T19:15:09Z","references":["https://osv.dev/vulnerability/GHSA-77gc-fj98-665h","https://nvd.nist.gov/vuln/detail/CVE-2016-9122","https://github.com/square/go-jose/pull/111","https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6","https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96","https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507","https://hackerone.com/reports/169629","https://github.com/square/go-jose","https://www.openwall.com/lists/oss-security/2016/11/03/1","http://www.openwall.com/lists/oss-security/2016/11/03/1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-77gc-fj98-665h","url":"https://osv.dev/vulnerability/GHSA-77gc-fj98-665h"}],"summary":"Go JOSE Signature Validation Bypass"}