CVE-2015-9259 Information

Description

In Docker Notary before 0.1 the checkRoot function in gotuf/client/client.go does not check expiry of root.json files despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise an attacker can produce update files referring to an old root.json file.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://docs.docker.com/notary/changelog/ https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8