CVE catalog

CVE-2016-9123

golang-gopkg-square-go-jose.v1: CVE-2016-9123

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.15% · Oct 25, 2026

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-gopkg-square-go-jose.v1sid1.1.2-4fixed
Debiangolang-gopkg-square-go-jose.v1forky1.1.2-4fixed
Debiangolang-gopkg-square-go-jose.v1trixie1.1.2-4fixed
Debiangolang-gopkg-square-go-jose.v1bookworm1.1.2-4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-gopkg-square-go-jose.v1sourcesid1.0.5-1not yet assignedNot reportedNot reported
Debiangolang-gopkg-square-go-jose.v1sourceforky1.0.5-1not yet assignedNot reportedNot reported
Debiangolang-gopkg-square-go-jose.v1sourcetrixie1.0.5-1not yet assignedNot reportedNot reported
Debiangolang-gopkg-square-go-jose.v1sourcebookworm1.0.5-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-gopkg-square-go-jose.v1-dev]Fixed

    Source package: [golang-gopkg-square-go-jose.v1]

    Details (2)

    • 1.1.2-4 · all · bookworm

      Fixed · Fixed: 1.0.5-1

      dsa · golang-gopkg-square-go-jose.v1 · debian · bookworm; dsa · golang-gopkg-square-go-jose.v1 · debian · 12

    • 1.1.2-4 · all · bookworm

      Fixed · Fixed: 1.0.5-1

      dsa · golang-gopkg-square-go-jose.v1 · debian · bookworm; dsa · golang-gopkg-square-go-jose.v1 · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]