Unscored CVE-2015-3229 EUVD-2015-3285GHSA-cg43-cf45-g8h6

fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to downloa…

Published Oct 16, 2017 · Updated Aug 6, 2024 · Assigned by redhat

Description

fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic updates.

References

[oss-security] 20150612 Fedora Atomic - downloads updates over HTTP (CVE-2015-3229) mailing-list
[spins] 20160606 cloud-atomic: Use https for the fedora-atomic ostree remote mailing-list
https://bugzilla.redhat.com/show_bug.cgi?id=1231800
75185 vdb-entry