CVE-2015-9259 Security feature bypass in n/a
Docker Notary fails to validate root.json expiry, allowing attackers to bypass security checks using old root files after key compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-9259?
CVE-2015-9259 is a critical vulnerability in n/a, published on 31 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Weakness: CWE-434
Which versions are affected by CVE-2015-9259?
It affects 1 product.
Products include Docker Notary.
How do I fix CVE-2015-9259?
Upgrade to a fixed version.
Is CVE-2015-9259 being exploited?
There is no known exploitation of CVE-2015-9259 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-9259, GHSA-2m6m-p8vh-r2f9.