Vulnerability Report: GO-2023-1859

  • GHSA-rm8v-mxj3-5rmq
  • Affects: github.com/lestrrat-go/jwx, github.com/lestrrat-go/jwx/v2
  • Published: Jun 22, 2023

AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data.

Affected Packages

Aliases

References

Feedback

See anything missing or incorrect? Suggest an edit to this report.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.