CVE-2015-9259: Docker Notary

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.

Affected products

• Docker Notary: before 0.1 (fixed in 0.1)

Published 2018-03-31. Last modified 2026-06-17.