VULNERABILITY INTELLIGENCE

CVE-2015-9259

CVSS score9.8 CRITICAL
EPSS probability1.29%
CISA KEVNot currently listed
Published2018-03-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.

Weakness classification

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references