CVE-2016-9121

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
n/a	Go JOSE All versions before 1.0.4	Go JOSE All versions before 1.0.4

References

http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/164590Permissions Required
http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/164590Permissions Required

Timeline

Published: Mar 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-91227.5go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However,CVE-2016-91237.5go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypa CVE-2016-91249.8Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vu CVE-2016-91259.8Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by CVE-2016-91265.4Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the CVE-2016-91278.8Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CVE-2016-91285.4Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS atta CVE-2016-91295.3Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address CVE-2016-91305.4Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,CVE-2016-91317.5named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of ser CVE-2016-91329.8In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be co CVE-2016-91347.5Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Di