CVE-2016-9122 (High) detected in github.com/docker/distribution-v2.7.1

[mend-for-github-com]

CVE-2016-9122 - High Severity Vulnerability

Vulnerable Library - github.com/docker/distribution-v2.7.1

The toolkit to pack, ship, store, and deliver container content

Dependency Hierarchy:

• ❌ github.com/docker/distribution-v2.7.1 (Vulnerable Library)

Found in HEAD commit: 549c2321b216d811654d8e364e811dbca812a5a6

Found in base branch: master

Vulnerability Details

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Publish Date: 2017-03-28

URL: CVE-2016-9122

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9122

Release Date: 2017-03-28

Fix Resolution: 1.0.4

---

⛑️ Automatic Remediation is available for this issue