CVE-2016-9123
High
Description
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGo-jose
PublishedMar 28, 2017
First seenMar 28, 2017
How to fix
Update
- github.com/square/go-jose0.0.0-20160903044734-789a4c4bd4c1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| go-jose_project go-jose | v ≤ 1.0.4 | — |
| github.com/square/go-joseGo | v < 0.0.0-20160903044734-789a4c4bd4c1 | 0.0.0-20160903044734-789a4c4bd4c1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.