CVE-2016-9122

{"id": "CVE-2016-9122", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-03-28T02:59:00.260", "references": [{"url": "http://www.openwall.com/lists/oss-security/2016/11/03/1", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/169629", "tags": ["Permissions Required"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated."}, {"lang": "es", "value": "go-jose en versiones anteriores a 1.0.4 sufre de la explotaci\u00f3n de m\u00faltiples firmas. La librer\u00eda go-jose soporta mensajes con varias firmas. Sin embargo, al validar un mensaje firmado el API no indic\u00f3 qu\u00e9 firma era v\u00e1lida, lo que podr\u00eda conducir a confusi\u00f3n. Por ejemplo, los usuarios de la biblioteca pueden leer de forma err\u00f3nea valores de cabecera protegidos de una firma adjunta que era diferente de la validada originalmente."}], "lastModified": "2017-03-29T17:49:32.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "461700A0-1ABE-4A30-9C79-80C835D8B62E", "versionEndIncluding": "1.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}