InformationThe RPM Package Manager implements GPG key signing to verify package integrity during and after installation.
It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system. To this end, verify that GPG keys are configured correctly for your system.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
SolutionUpdate your package manager GPG keys in accordance with site policy.
Fedora public keys: https://getfedora.org/security/
NIST SP 800-53 Rev. 5: