CVE-2017-2623
published 2018-07-27CVE-2017-2623: It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with…
PriorityP422medium5.3CVSS 3.0
AVNACHPRNUIRSUCNIHAN
EPSS
1.03%
59.7th percentile
It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| rpm-ostree | rpm-ostree | < 2017.3 | 2017.3 |
| rpm-ostree | rpm-ostree-client | < 2017.3 | 2017.3 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rpm-ostree-client: fails to check gpg package signatures when layering
vendor_redhat·2017-03-02·CVSS 5.3
CVE-2017-2623 [MEDIUM] CWE-295 rpm-ostree-client: fails to check gpg package signatures when layering
rpm-ostree-client: fails to check gpg package signatures when layering
It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.
It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.
Mitigation: This issue is partially mitigated on RHEL Atomic Host, where default cer
GHSA
GHSA-v473-h83f-x76x: It was discovered that rpm-ostree and rpm-ostree-client before 2017
ghsa_unreviewed·2022-05-13
CVE-2017-2623 [MEDIUM] CWE-295 GHSA-v473-h83f-x76x: It was discovered that rpm-ostree and rpm-ostree-client before 2017
It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.
No detection rules found.
No public exploits indexed.
2018-07-27
Published