CVE-2016-9122 (High) detected in github.com/docker/distribution-v2.7.1-0.20190205005809-0d3efadf0154+incompatible

[mend-for-github-com]

CVE-2016-9122 - High Severity Vulnerability

Vulnerable Library - github.com/docker/distribution-v2.7.1-0.20190205005809-0d3efadf0154+incompatible

The Docker toolset to pack, ship, store, and deliver content

Library home page: https://proxy.golang.org/github.com/docker/distribution/@v/v2.7.1-0.20190205005809-0d3efadf0154+incompatible.zip

Dependency Hierarchy:

• ❌ github.com/docker/distribution-v2.7.1-0.20190205005809-0d3efadf0154+incompatible (Vulnerable Library)

Found in HEAD commit: 74c0db1e26014a7f5e115cea39a5b8613c912db7

Found in base branch: master

Vulnerability Details

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Publish Date: 2017-03-28

URL: CVE-2016-9122

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0011

Release Date: 2017-03-28

Fix Resolution: v1.1.0