Riskcovery

CVE-2016-9121

State
Published
Severity
Not scored
Published
Mar 28, 2017
Updated
Aug 6, 2024
Reserved
Oct 31, 2016

Read the record on cve.org

Description

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Go JOSE All versions before 1.0.4n/a
  • Go JOSE All versions before 1.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.