7.5high
CVE-2016-9123
Integer Overflow in go-jose
Also known as GHSA-3fx4-7f69-5mmg, GO-2020-0009
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
0
none known
Summary
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Exploit prediction (EPSS)
2.15% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/square/go-jose | <0.0.0-20160903044734-789a4c4bd4c1 | 0.0.0-20160903044734-789a4c4bd4c1 |
Affected products
- n/a Go JOSE All versions before 1.0.5
Classification
- Weakness
- CWE-190 Integer Overflow or Wraparound
References
- github.com /square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 · x_refsource_MISC, x_transferred
- openwall.com /lists/oss-security/2016/11/03/1 · x_refsource_MISC, x_transferred
- hackerone.com /reports/165170 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-9123 · advisory
- pkg.go.dev /vuln/GO-2020-0009 · web
- openwall.com /lists/oss-security/2016/11/03/1 · web
Sources
- CVE List: CVE-2016-9123
- GitHub Advisory: GHSA-3fx4-7f69-5mmg
- NVD: CVE-2016-9123
- OSV: GO-2020-0009
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.