It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.

Published 8 y ago 2018-07-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.0%

percentile 63%

Public exploits

none known

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

Exploit prediction (EPSS)

1.01% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N`
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N`
NVD	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected products

Project Atomic rpm-ostree,

Classification

Weakness

CWE-295 Improper Certificate Validation

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2623 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:0444 · vendor-advisory, x_refsource_REDHAT, x_transferred
securityfocus.com /bid/96558 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2017-2623
NVD: CVE-2017-2623

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.