Red Hat Security Advisory

RHSA-2017:0444

rpm-ostree and rpm-ostree-client security, bug fix, and enhancement update

Released 2017-03-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Atomic Host 7 rpm-ostree-2017.1-5.atomic.el7, rpm-ostree-client-2017.1-6.atomic.el7

TI-2017-01874 CVE-2017-2623 · GHSA-v473-h83f-x76x

LOW 26

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.

CVSS 3.0MEDIUM 5.3 Network No auth User interaction EPSS 0.01013 Published 2018-07-27 Fixed CWE-295