PT-2018-7144 · Red Hat · Rhel Atomic Host+2

Publicado 2018-07-27 · Atualizado 2019-10-09 · CVE-2017-2623

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: rpm-ostree versions prior to 2017.3 rpm-ostree-client versions prior to 2017.3

Description: A issue was found where rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages during layering, potentially allowing packages with unsigned or badly signed content to be accepted. This issue is partially mitigated on RHEL Atomic Host due to the use of certificate pinning by default.

Recommendations: For rpm-ostree versions prior to 2017.3, update to version 2017.3 or later to resolve the issue. For rpm-ostree-client versions prior to 2017.3, update to version 2017.3 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-2623

RHSA-2017:0444

Produtos afetados

Rhel Atomic Host

Rpm-Ostree

Rpm-Ostree-Client

Referências · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623 · Nota
• https://osv.dev/vulnerability/CVE-2017-2623 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:0444 · Aviso do Fabricante
• http://securityfocus.com/bid/96558 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2623 · Nota de Segurança