CVE-2016-9121.json

{
  "schema_version": "1.6.3",
  "id": "CVE-2016-9121",
  "modified": "2024-05-20T16:03:47Z",
  "published": "2021-04-14T20:04:52Z",
  "aliases": [
    "GO-2020-0010",
    "GHSA-86r9-39j9-99wp"
  ],
  "related": [],
  "summary": "Elliptic curve key disclosure in github.com/square/go-jose. go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack. go-jose en versiones anteriores a 1.0.4 sufre de un ataque de curva no válida para el algoritmo ECDH-ES. Al derivar una clave compartida usando ECDH-ES para un mensaje encriptado, go-jose descuidado para comprobar que la clave pública recibida en un mensaje está en la misma curva que la clave privada estática del receptor, haciéndola vulnerable a una curva no válida ataque. CWE-326",
  "details": "When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key. go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack",
  "severity": [
    {
      "type": "CVSS_V2",
      "score": "6.4"
    },
    {
      "type": "CVSS_V3",
      "score": "9.1"
    }
  ],
  "affected": [
    {
      "package": {
        "name": "square/go-jose",
        "purl": "https://github.com/square/go-jose"
      },
      "severity": [],
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "last_affected": "1.0.3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2016/11/03/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/03/1"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/164590"
    }
  ],
  "credits": [
    {
      "name": "Quan Nguyen from Google's Information Security Engineering Team"
    },
    {
      "name": "Cedric Staub",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "database_specific": {
    "metrics": {
      "cvssMetricV30": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "3.0",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      ],
      "cvssMetricV2": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "2.0",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "accessVector": "NETWORK",
            "accessComplexity": "LOW",
            "authentication": "NONE",
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.4
          },
          "baseSeverity": "MEDIUM",
          "exploitabilityScore": 10.0,
          "impactScore": 4.9,
          "acInsufInfo": false,
          "obtainAllPrivilege": false,
          "obtainUserPrivilege": false,
          "obtainOtherPrivilege": false,
          "userInteractionRequired": false
        }
      ]
    },
    "cwe_details": [
      {
        "cwe_id": "CWE-326",
        "name": "Primary",
        "description": "",
        "source": "nvd@nist.gov",
        "url": ""
      }
    ],
    "repositories": [
      {
        "url": "https://github.com/square/go-jose",
        "name": "square/go-jose",
        "description": "An implementation of JOSE standards (JWE, JWS, JWT) in Go",
        "date_created": "2014-11-14 18:27:31",
        "date_last_push": "2022-03-26 15:25:19",
        "owner": "square",
        "forks_count": "347.0",
        "stars_count": "1944.0"
      }
    ],
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "461700A0-1ABE-4A30-9C79-80C835D8B62E",
            "versionEndIncluding": "1.0.3"
          }
        ]
      }
    ],
    "vulndb_data": {
      "url": "https://pkg.go.dev/vuln/GO-2020-0010",
      "review_status": "REVIEWED"
    },
    "datasources": {
      "govuln": true,
      "nvd": true,
      "cvefixes": true
    }
  }
}