CVE-2016-9122: Improper Access Control

March 28, 2017 (updated March 29, 2017)

The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

References

github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
nvd.nist.gov/vuln/detail/CVE-2016-9122

Detect and mitigate CVE-2016-9122 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →