CVE-2016-9122 Go JOSE Signature Validation Bypass
Attackers can exploit multiple signatures to confuse validation logic, potentially bypassing security checks in applications using the go-jose library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9122?
CVE-2016-9122 is a high-severity vulnerability in Go JOSE All versions before 1.0.4, published on 28 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Weakness: CWE-284
Which versions are affected by CVE-2016-9122?
3 open source packages ship an affected version, including gopkg.in/square/go-jose.v1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gopkg.in/square/go-jose.v1 Go | All versions | 1.1.0 |
gopkg.in/square/go-jose.v1 Go | All versions | 1.1.0 |
gopkg.in/square/go-jose.v1 Go | All versions | 1.1.0 |
Products include Go-Jose Project Go-Jose.
How do I fix CVE-2016-9122?
Upgrade gopkg.in/square/go-jose.v1 to 1.1.0 or later.
Is CVE-2016-9122 being exploited?
There is no known exploitation of CVE-2016-9122 in the wild and no public exploit code.
Other vulnerabilities in Go JOSE All versions before 1.0.4
Sources
Also known as DEBIAN-CVE-2016-9122, GHSA-77gc-fj98-665h, GO-2022-0945.