PT-2018-4569 · Docker · Docker Notary

Publicado 2018-03-31 · Atualizado 2022-05-14 · CVE-2015-9258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Docker Notary versions prior to 0.1

Description The issue allows an attacker to potentially forge a signature by misinterpreting an RSA-PSS key as Ed25519 elliptic-curve data, due to the attacker's control over the field specifying the signature algorithm.

Recommendations For Docker Notary versions prior to 0.1, update to version 0.1 or later to resolve the issue.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-310

CWE-347

Identificadores relacionados

CVE-2015-9258

GHSA-785H-HRF7-GQXC

Produtos afetados

Docker Notary

Referências · 11

• https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-9258 · Aviso do Fabricante
• https://web.archive.org/web/20160305015752/https://docs.docker.com/notary/changelog · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9258 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2015-9258 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-785h-hrf7-gqxc · Aviso do Fabricante
• https://docs.docker.com/notary/changelog · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-9258 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-9258 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-9258 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-9258 · Aviso do Fabricante