Candidate: CVE-2016-9122
PublicDate: 2017-03-28 02:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9122
 http://www.openwall.com/lists/oss-security/2016/11/03/1
 https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6
 https://hackerone.com/reports/169629
Description:
 go-jose before 1.0.4 suffers from multiple signatures exploitation. The
 go-jose library supports messages with multiple signatures. However, when
 validating a signed message the API did not indicate which signature was
 valid, which could potentially lead to confusion. For example, users of the
 library might mistakenly read protected header values from an attached
 signature that was different from the one originally validated.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Quan Nguyen
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]

Patches_golang-gopkg-square-go-jose.v1:
upstream_golang-gopkg-square-go-jose.v1: released (1.0.5-1)
precise_golang-gopkg-square-go-jose.v1: DNE
precise/esm_golang-gopkg-square-go-jose.v1: DNE
trusty_golang-gopkg-square-go-jose.v1: DNE
trusty/esm_golang-gopkg-square-go-jose.v1: DNE
vivid/stable-phone-overlay_golang-gopkg-square-go-jose.v1: DNE
vivid/ubuntu-core_golang-gopkg-square-go-jose.v1: DNE
xenial_golang-gopkg-square-go-jose.v1: DNE
yakkety_golang-gopkg-square-go-jose.v1: ignored (reached end-of-life)
zesty_golang-gopkg-square-go-jose.v1: not-affected (1.1.0-3)
devel_golang-gopkg-square-go-jose.v1: not-affected (1.1.0-3)