A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0144 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-2307:
    A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for     package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted     code to be installed into an image being built.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:2961 advisory.

    * osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2961 advisory.

    osbuild     [110-1]
    - New upstream release

    [109-1]
    - New upstream release

    [106-1]
    - New upstream release

    [105-1]
    - New upstream release

    [104-2]
    - Fix unit tests in RHEL CI by backporting upstream fixes

    [104-1]
    - New upstream release

    [101-1]
    - New upstream release

    [100-2]
    - Change unit-test timeout from 3h to 4h

    [100-1]
    - New upstream release

    [96-1]
    - New upstream release

    [95-1]
    - New upstream release

    [94-1]
    - New upstream release

    osbuild-composer     [101-1]
    - New upstream release

    [100-1]
    - New upstream release

    [99-1]
    - New upstream release

    [98-1]
    - New upstream release

    [96-1]
    - New upstream release

    [95-1]
    - New upstream release

    [94-1]
    - New upstream release

    [93-1]
    - New upstream release

    [92-1]
    - New upstream release

    [91-1]
    - New upstream release

    [90-1]
    - New upstream release

    [89-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2961 advisory.

    Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits,     that uses osbuild under the hood.

    Security Fix(es):

    * osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2961 advisory.

  - A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for     package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted     code to be installed into an image being built. (CVE-2024-2307)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2119 advisory.

    osbuild     [110-1]
    - New upstream release

    [109-1]
    - New upstream release

    [106-1]
    - New upstream release

    [105-1]
    - New upstream release

    [104-2]
    - Fix unit tests in RHEL CI by backporting upstream fixes

    [104-1]
    - New upstream release

    [103-1]
    - New upstream release

    [102-1]
    - New upstream release

    [101-2]
    - Change unit-test timeout from 3h to 4h
    - Rebuild after failed gating

    [101-1]
    - New upstream release

    [100-1]
    - New upstream release

    [99-1]
    - New upstream release

    [98-1]
    - New upstream release

    [97-1]
    - New upstream release

    [96-1]
    - New upstream release

    [95-1]
    - New upstream release

    [94-1]
    - New upstream release

    osbuild-composer     [101-1]
    - New upstream release

    [100-1]
    - New upstream release

    [99-1]
    - New upstream release

    [98-1]
    - New upstream release

    [96-1]
    - New upstream release

    [95-1]
    - New upstream release

    [94-1]
    - New upstream release

    [93-1]
    - New upstream release

    [92-1]
    - New upstream release

    [91-1]
    - New upstream release

    [89-1]
    - New upstream release

    [88-1]
    - New upstream release

    [87-1]
    - New upstream release

    [86-1]
    - New upstream release

    [85-1]
    - New upstream release

    [84-1]
    - New upstream release

    [82-1]
    - New upstream release

    [80-1]
    - New upstream release

    [79-1]
    - New upstream release

    [77-1]
    - New upstream release

    [76-1]
    - New upstream release

    [75-1]
    - New upstream release

    [74-1]
    - New upstream release

    [73-1]
    - New upstream release

    [72-1]
    - New upstream release

    [71-1]
    - New upstream release

    [70-1]
    - New upstream release

    [69-1]
    - New upstream release

    [68-1]
    - New upstream release

    [67-2]
    - Fix functional tests to make them pass in RHEL-9.2 gating

    [67-1]
    - New upstream release

    [62-1]
    - New upstream release

    [60-1]
    - New upstream release

    [59-1]
    - New upstream release

    [58-1]
    - New upstream release

    [57-1]
    - New upstream release

    [55-1]
    - New upstream release

    [54-1]
    - New upstream release

    [53-1]
    - New upstream release

    [51-1]
    - New upstream release

    [46-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2119 advisory.

    Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits,     that uses osbuild under the hood.

    Security Fix(es):

    * osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of osbuild-composer installed on the remote host is prior to 94. It may, therefore, be affected by a race condition. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

ID	Name	Product	Family	Severity
236249	Alibaba Cloud Linux 3 : 0144: osbuild-composer bug fix, enhancement and (ALINUX3-SA-2024:0144)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
200626	Rocky Linux 8 : Image builder components bug fix, enhancement and (RLSA-2024:2961)	Nessus	Rocky Linux Local Security Checks	medium
197989	Oracle Linux 8 : Image / builder / components (ELSA-2024-2961)	Nessus	Oracle Linux Local Security Checks	medium
197784	RHEL 8 : Image builder components (RHSA-2024:2961)	Nessus	Red Hat Local Security Checks	medium
197670	CentOS 8 : Image builder components bug fix, enhancement and (CESA-2024:2961)	Nessus	CentOS Local Security Checks	medium
195066	Oracle Linux 9 : Image / builder / components (ELSA-2024-2119)	Nessus	Oracle Linux Local Security Checks	medium
194770	RHEL 9 : Image builder components (RHSA-2024:2119)	Nessus	Red Hat Local Security Checks	medium
192468	osbuild-composer < 94 Race Condition	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-2307

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium