CVE-2015-9258

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability

published March 31, 2018

CVSS
—
EPSS
1%
Percentile
63.1
In the wild
Unconfirmed
What it is

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01027 · 63.1th percentile
Published
2018-03-31T21:00Z
EPSS history
Timeline
  • 31 MAR 21:00Z
    In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability
    cvelistv5