A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-coreUpgrade osbuild-composerUpgrade osbuild-composer-worker | May 8, 2024 | Mar 19, 2024 |
| Oracle_linux | — | Upgrade osbuild-selinuxUpgrade osbuild-composer-coreUpgrade osbuild-depsolve-dnfUpgrade osbuild-lvm2Upgrade osbuild-composerUpgrade osbuild-composer-workerUpgrade python3-osbuildUpgrade osbuild-luks2Upgrade osbuild-ostreeUpgrade osbuild | May 7, 2024 | Mar 19, 2024 |
| Redhat_linux | — | Upgrade osbuild-composer-coreUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-ostreeUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuild-composer-debuginfoUpgrade osbuild-composer-workerUpgrade osbuildUpgrade osbuild-luks2Upgrade python3-osbuildUpgrade osbuild-depsolve-dnfUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-worker-debuginfo | May 1, 2024 | Mar 19, 2024 |
| Rocky_linux | — | Upgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer | Jun 17, 2024 | Mar 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub