PT-2018-4569 · Docker · Docker Notary

Published 2018-03-31 · Updated 2022-05-14 · CVE-2015-9258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Docker Notary versions prior to 0.1

Description The issue allows an attacker to potentially forge a signature by misinterpreting an RSA-PSS key as Ed25519 elliptic-curve data, due to the attacker's control over the field specifying the signature algorithm.

Recommendations For Docker Notary versions prior to 0.1, update to version 0.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-310

CWE-347

Related Identifiers

CVE-2015-9258

GHSA-785H-HRF7-GQXC

Affected Products

Docker Notary

References · 11

• https://security-tracker.debian.org/tracker/CVE-2015-9258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9258 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-9258 · Security Note
• https://osv.dev/vulnerability/GHSA-785h-hrf7-gqxc · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-9258 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-9258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-9258 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-9258 · Vendor Advisory
• https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf · Note
• https://web.archive.org/web/20160305015752/https://docs.docker.com/notary/changelog · Note
• https://docs.docker.com/notary/changelog · Note