En bref
- CVE-2016-9121 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant github.com/square/go-jose, gopkg.in/square/go-jose.v1, go-jose (go-jose project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.4%, plus élevée que 72.8% des vulnérabilités.
- Correctif : mettre à jour vers 1.0.4 ou plus récent.
Description
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
NVD description
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Autres vulnérabilités de github.com/square/go-jose
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free