CVE-2016-9123
Fixed in a distro release EPSS 2%
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Products: go-jose_project go-jose
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/square/go-jose | 0.0.0-20160903044734-789a4c4bd4c1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | golang-gopkg-square-go-jose.v1 | 1.0.5-1 |
| Debian 13 | golang-gopkg-square-go-jose.v1 | 1.0.5-1 |
| Debian 14 | golang-gopkg-square-go-jose.v1 | 1.0.5-1 |