FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not     being enabled if configured to be on. (CVE-2017-1000001)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not
    being enabled if configured to be on. (CVE-2017-1000001)

Fix validation logic in the base consumer

The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validate_signatures switch.

There was a bug here where the default value provided in the base class made it appear as if *all* child consumers had turned *off* validation, which is incorrect.

This fix turns on signature validation by default while preserving the ability of child consumers to override the on-disk configuration in special cases.

  - Fixes: CVE-2017-1000001

  - Reviewed-by: Patrick Uiterwijk

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
263462	Linux Distros Unpatched Vulnerability : CVE-2017-1000001	Nessus	Misc.	high
421830	SCA: security update for FedMsg (GHSA-p7xc-35m8-57pr)	Tenable Cloud Security	SCA Checks	high
421830	SCA: security update for FedMsg (GHSA-p7xc-35m8-57pr)	Tenable Self-Hosted Container Security	SCA Checks	high
96896	Fedora 24 : fedmsg (2017-a73bc7ac5d)	Nessus	Fedora Local Security Checks	high
96741	Fedora 25 : fedmsg (2017-fff6e1af37)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-1000001

high

Tenable Plugins

high

high

high

high

high