CVE-2017-2623CWE-295

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering

Medium · published July 27, 2018

CVSS v3.0
5.3
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01013 · 62.9th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2018-07-27T18:00Z
EPSS history
Timeline
  • 27 JUL 18:00Z
    It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering
    cvelistv5