{"id":"CVE-2016-9123","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:42:10Z","title":"go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures","vendor":null,"product":null,"tier":"tail","description":{"text":"go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02149,"percentile":0.82123,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/03/1","tags":["x_refsource_MISC"]},{"url":"https://hackerone.com/reports/165170","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":16.42}]},"affectedVersions":[{"vendor":"n/a","product":"Go JOSE All versions before 1.0.5","versions":["Go JOSE All versions before 1.0.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/square/go-jose","vulnerableRanges":["<0.0.0-20160903044734-789a4c4bd4c1"],"patched":["0.0.0-20160903044734-789a4c4bd4c1"],"from":["GHSA-3fx4-7f69-5mmg","GO-2020-0009"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1255","exploited":false,"provenance":"source"}}