PT-2018-4570 · Docker · Docker Notary

Published 2018-03-31 · Updated 2018-05-01 · CVE-2015-9259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Notary versions prior to 0.1

Description The issue arises from the checkRoot function in gotuf/client/client.go, which fails to check the expiry of root.json files. This allows an attacker to produce update files that reference an old root.json file, even if a user creates a new root.json file after a key compromise.

Recommendations For Docker Notary versions prior to 0.1, update to version 0.1 or later to resolve the issue. As a temporary workaround, consider manually verifying the expiry of root.json files to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-9259

Affected Products

Docker Notary

References · 9

• https://osv.dev/vulnerability/DEBIAN-CVE-2015-9259 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-9259 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-9259 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-9259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-9259 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-9259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9259 · Security Note
• https://docs.docker.com/notary/changelog · Vendor Advisory
• https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf · Note