It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

https://github.com/projectatomic/rpm-ostree/releases/tag/v2017.3

This release includes a fix for [CVE-2017-2623](https://bugzilla.redhat.com/show_bug.cgi?id=1422157).

There are a few new features, such as `systemctl reload rpm-ostreed` now being supported. Some bugfixes such as memory leak fixes. Besides that, there's a lot of internal refactoring going on in preparation for work on local RPM installation.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system trees. It provides commands which can be used both on client systems as well as server-side composes.
The rpm-ostree-client package provides commands usable on client systems to upgrade and rollback.

The following packages have been upgraded to a later upstream version:
rpm-ostree (2017.1), rpm-ostree-client (2017.1). (BZ#1416089)

Security Fix(es) :

* It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering.
Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default. (CVE-2017-2623)

This issue was discovered by Colin Walters (Red Hat).

ID	Name	Product	Family	Severity
97867	Fedora 24 : rpm-ostree (2017-788129b61c)	Nessus	Fedora Local Security Checks	medium
97839	Fedora 25 : rpm-ostree (2017-003fa5648c)	Nessus	Fedora Local Security Checks	medium
97548	RHEL 7 : rpm-ostree and rpm-ostree-client (RHSA-2017:0444)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2017-2623

medium

Tenable Plugins

medium

medium

medium