Docker Notary Signature Algorithm Not Matched to Key vulnerability

ALTO 7.5CVE-2015-9258 · GHSA-785h-hrf7-gqxc · Published 31/03/2018 · updated 17/06/2026

In breve

CVE-2015-9258 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/docker/notary, notary (docker).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.6% delle vulnerabilità.
Correzione: aggiornare a 0.1.0, 0.1 o successiva.

Package	Affected versions	Patched versions
github.com/docker/notary Go	`< 0.1.0`	`0.1.0`
notary docker	`< 0.1`	`0.1`

Description

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-9258 · ADVISORY
theupdateframework/notary · WEB
web.archive.org/web/20160305015752/https://docs.docker.com/notary/changelog · WEB
docs.docker.com/notary/changelog · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free