Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-9258

CVE-2015-9258: Docker Notary Signature Algorithm Not Matched to Key vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2015-9258
GHSA ID
GHSA-785h-hrf7-gqxc
EPSS Score
0.46551%
CWE
CWE-347
Published
5/14/2022
Updated
8/2/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/docker/notarygo< 0.1.00.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The CVE description explicitly identifies gotuf/signed/verify.go as the vulnerable component. The core vulnerability stems from improper algorithm validation during signature verification. The Verify() function would be the primary location where signature validation occurs, and the lack of algorithm/key compatibility check would manifest here. While no direct patch is shown, the vulnerability pattern matches a missing validation step in the verification workflow that would be observable in this function's execution path during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In *o*k*r Not*ry ***or* *.*, *otu*/si*n**/v*ri*y.*o **s * Si*n*tur* *l*orit*m Not M*t**** to K*y vuln*r**ility. ****us* *n *tt**k*r *ontrols t** *i*l* sp**i*yin* t** si*n*tur* *l*orit*m, t**y mi**t (*or *x*mpl*) ** **l* to *or** * si*n*tur* *y *or*in

Reasoning

T** *V* **s*ription *xpli*itly i**nti*i*s `*otu*/si*n**/v*ri*y.*o` *s t** vuln*r**l* *ompon*nt. T** *or* vuln*r**ility st*ms *rom improp*r *l*orit*m v*li**tion *urin* si*n*tur* v*ri*i**tion. T** `V*ri*y()` *un*tion woul* ** t** prim*ry lo**tion w**r*