GO-2020-0010

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2020-0010

Import Source

https://vuln.go.dev/ID/GO-2020-0010.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2020-0010

Aliases

Published

2021-04-14T20:04:52Z

Modified

2024-05-20T16:03:47Z

Summary

Elliptic curve key disclosure in github.com/square/go-jose

Details

When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2020-0010"
}

References

Credits

- Quan Nguyen from Google's Information Security Engineering Team

Affected packages

Go / github.com/square/go-jose

Package

Name: github.com/square/go-jose; View open source insights on deps.dev
Purl: pkg:golang/github.com/square/go-jose

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.4

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "DeriveECDHES"
            ],
            "path": "github.com/square/go-jose/cipher"
        },
        {
            "symbols": [
                "JsonWebEncryption.Decrypt",
                "JsonWebKey.UnmarshalJSON",
                "ecDecrypterSigner.decryptKey",
                "rawJsonWebKey.ecPublicKey"
            ],
            "path": "github.com/square/go-jose"
        }
    ]
}