ECDH-ES Algorithm Vulnerability in Go-Jose by Square
CVE-2016-9121

9.1CRITICAL

Key Information:

Vendor: Go-jose Project
Status: Go Jose All Versions Before 1.0.4
Vendor: CVE Published:; 28 March 2017

🔔 Create Go-jose Project Vulnerability Alert

What is CVE-2016-9121?

Go-Jose, a library by Square, is affected by a significant security flaw in its ECDH-ES algorithm. This vulnerability arises from the library's failure to verify whether the public key received in a message is from the same elliptic curve as the static private key of the receiver. As a result, an attacker could exploit this oversight by using an invalid curve, enabling them to derive the shared key utilized for encrypted communications. This susceptibility emphasizes the importance of strict key validation to maintain cryptographic integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch