PT-2018-7144 · Red Hat · Rhel Atomic Host+2

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-2623

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: rpm-ostree versions prior to 2017.3 rpm-ostree-client versions prior to 2017.3

Description: A issue was found where rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages during layering, potentially allowing packages with unsigned or badly signed content to be accepted. This issue is partially mitigated on RHEL Atomic Host due to the use of certificate pinning by default.

Recommendations: For rpm-ostree versions prior to 2017.3, update to version 2017.3 or later to resolve the issue. For rpm-ostree-client versions prior to 2017.3, update to version 2017.3 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-2623

RHSA-2017:0444

Affected Products

Rhel Atomic Host

Rpm-Ostree

Rpm-Ostree-Client

References · 5

• https://osv.dev/vulnerability/CVE-2017-2623 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2623 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623 · Note
• http://securityfocus.com/bid/96558 · Note