A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade osbuild-composer-core | May 8, 2024 | Mar 19, 2024 |
| Oracle_linux | — | Upgrade osbuild-selinuxUpgrade osbuild-depsolve-dnfUpgrade osbuild-composer-coreUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade osbuild-ostreeUpgrade python3-osbuildUpgrade osbuildUpgrade osbuild-composerUpgrade osbuild-lvm2 | May 7, 2024 | Mar 19, 2024 |
| Redhat_linux | — | Upgrade osbuild-composer-debuginfoUpgrade python3-osbuildUpgrade osbuild-composer-tests-debuginfoUpgrade osbuildUpgrade osbuild-depsolve-dnfUpgrade osbuild-composer-workerUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-luks2Upgrade osbuild-composerUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuild-ostreeUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-core | May 1, 2024 | Mar 19, 2024 |
| Rocky_linux | — | Upgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-worker | Jun 17, 2024 | Mar 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub