{"action":"Upgrade gopkg.in/square/go-jose.v1 to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"gopkg.in/square/go-jose.v1","cve_ids":["CVE-2016-9122"],"ecosystem":"Go","epss":0.01969,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-77gc-fj98-665h","id":"tcs_01M5KFXD3FHAN4FQDP4BHW7BTZ","modified_at":"2024-05-20T16:03:47Z","published_at":"2022-08-22T17:59:45Z","references":["https://osv.dev/vulnerability/GO-2022-0945","https://www.openwall.com/lists/oss-security/2016/11/03/1","https://github.com/square/go-jose/pull/111","https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6","https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96","https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2022-0945","url":"https://osv.dev/vulnerability/GO-2022-0945"}],"summary":"Signature validation bypass in gopkg.in/square/go-jose.v1"}