FW: Critical Vulnerability Uncovered in JSON Encryption

If you are using  <http://blogs.adobe.com/security>go-jose
<https://github.com/square/go-jose>, node-jose
<https://github.com/cisco/node-jose>, jose2go
<https://github.com/dvsekhvalnov/jose2go>, Nimbus JOSE+JWT
<https://bitbucket.org/connect2id/nimbus-jose-jwt/wiki/Home> or jose4
<https://bitbucket.org/b_c/jose4j/wiki/Home> with ECDH-ES
<https://tools.ietf.org/html/rfc7518>please update to the latest version. RFC
7516 aka JSON Web Encryption (JWE)
<https://tools.ietf.org/html/rfc7516> Invalid
Curve Attack
<http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.107.3920&rep=rep1&type=pdf>.
This can allow an attacker to recover the secret key of a party using JWE
with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static
(ECDH-ES) <https://tools.ietf.org/html/rfc7518>, where the sender could
extract receiver’s private key..


http://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovered-in-json-encryption.html

-- Christopher Allen