gopkg.in/square/go-jose.v1 (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package gopkg.in/square/go-jose.v1, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2016-9121 — CVSS 9.1 (critical): go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an…
• CVE-2016-9122 — CVSS 7.5 (high): go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures…