module = "github.com/square/go-jose"
package = "github.com/square/go-jose/cipher"

description = """
When using ECDH-ES an attacker can mount an invalid curve attack during
decryption as the supplied public key is not checked to be on the same
curve as the recievers private key.
"""

cve = "CVE-2016-9121"

credit = "Quan Nguyen from Google's Information Security Engineering Team"

symbols = ["DeriveECDHES", "ecDecrypterSigner.decryptKey", "rawJsonWebKey.ecPublicKey"]

[[versions]]
fixed = "v0.0.0-20160831185616-c7581939a365"

[[additional_packages]]
module = "github.com/square/go-jose"
symbols = ["JsonWebEncryption.Decrypt"]

[links]
commit = "https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507"
context = ["https://www.openwall.com/lists/oss-security/2016/11/03/1"]