vulnwire
7.5high

CVE-2016-9122

Go JOSE Signature Validation Bypass

Also known as GHSA-77gc-fj98-665h, GO-2022-0945

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 80%
Public exploits
0
none known

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Exploit prediction (EPSS)

1.97% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
gogopkg.in/square/go-jose.v1
<1.1.0
1.1.0

Affected products

  • n/a Go JOSE All versions before 1.0.4

Classification

Weakness

References

  • hackerone.com /reports/169629 · x_refsource_MISC, x_transferred
  • github.com /square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6 · x_refsource_MISC, x_transferred
  • openwall.com /lists/oss-security/2016/11/03/1 · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-9122 · advisory
  • github.com /square/go-jose/pull/111 · web
  • github.com /square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 · web
  • github.com /square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 · web
  • github.com /square/go-jose · package
  • openwall.com /lists/oss-security/2016/11/03/1 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.