Vulnerability Report: GO-2020-0010
- CVE-2016-9121, GHSA-86r9-39j9-99wp
- Affects: github.com/square/go-jose
- Published: Apr 14, 2021
- Modified: May 20, 2024
When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key.
Affected Packages
-
PathVersionsSymbols
-
before v1.0.4
-
before v1.0.4
Aliases
References
- https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507
- https://www.openwall.com/lists/oss-security/2016/11/03/1
- https://vuln.go.dev/ID/GO-2020-0010.json
Credits
- Quan Nguyen from Google's Information Security Engineering Team
Feedback
See anything missing or incorrect?
Suggest an edit to this report.