CVE-2016-9123
UnknownEPSS 2.15%
Last modified
CVE-2016-9123 is a vulnerability of currently unknown severity. go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.. EPSS estimates a 2.15% chance of exploitation in the next 30 days.
Description
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Go-Jose Project | Go-Jose | <= 1.0.4 |
References
- http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
- https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96Issue Tracking, Patch, Third Party Advisory
- https://hackerone.com/reports/165170Permissions Required
- http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
- https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96Issue Tracking, Patch, Third Party Advisory
- https://hackerone.com/reports/165170Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-9123?
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
How severe is CVE-2016-9123?
Severity scoring for CVE-2016-9123 is pending analysis. The EPSS model estimates a 2.15% probability of exploitation in the next 30 days.
How do I fix CVE-2016-9123?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-9117NULL Pointer Access in function imagetopnm of convert.c(jp2)…
- CVE-2016-9118Heap Buffer Overflow (WRITE of size 4) in function pnmtoimag…
- CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogu…
- CVE-2016-9120Race condition in the ion_ioctl function in drivers/staging/…7.8
- CVE-2016-9121go-jose before 1.0.4 suffers from an invalid curve attack fo…
- CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
- CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
- CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
- CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
- CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
- CVE-2016-9128Revive Adserver before 3.2.3 suffers from reflected XSS. The…
- CVE-2016-9129Revive Adserver before 3.2.3 suffers from Information Exposu…
Are you affected by CVE-2016-9123?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST