Skip to content
OpenAdvisories
Medium RHSA-2024:2961 1 CVE

Red Hat Security Advisory: Image builder components bug fix, enhancement and security update

Published Sep 16, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-core 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-core-debuginfo 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-debuginfo 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-debugsource 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-tests-debuginfo 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-worker 0:101-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream osbuild-composer-worker-debuginfo 0:101-1.el8

Vulnerabilities 1

  • Medium 6.1
    CVE-2024-2307

    Osbuild-composer: race condition may disable gpg verification for package repositories

    A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268513
  • article
    https://issues.redhat.com/browse/RHEL-1770
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2961.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-2307
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-2307
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-2307