CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2015-9258
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- docker:notary
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-785h-hrf7-gqxc | Go | github.com/docker/notary | <0.1.0 | 0.1.0 |
References
- https://docs.docker.com/notary/changelog/
- https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf
- https://docs.docker.com/notary/changelog/
- https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf