CVE-2015-9259 In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json f...
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/notary(Debian:12) | < 0.1~ds1-1 | 0.1~ds1-1 |
| debian/notary(Debian:13) | < 0.1~ds1-1 | 0.1~ds1-1 |
| docker github.com/docker/notary | < 0.1 | 0.1 |
References
- Debian Security Tracker CVE-2015-9259 vendor-advisory
- docs.docker.com vendor-advisory
- github.com third-party-advisory