CVE-2015-9258 Docker Notary Signature Algorithm Not Matched to Key vulnerability
HighCVSS 7.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/notary(Go) | < 0.1.0 | 0.1.0 |
| debian/notary(Debian:12) | < 0.1~ds1-1 | 0.1~ds1-1 |
| debian/notary(Debian:13) | < 0.1~ds1-1 | 0.1~ds1-1 |
| docker github.com/docker/notary | < 0.1 | 0.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com third-party-advisory
- web.archive.org
- github.com
- Debian Security Tracker CVE-2015-9258 vendor-advisory
- docs.docker.com third-party-advisory