CVE-2017-2623

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-27 · updated 2026-06-17
Weakness: CWE-295

Description

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

Affected products

Red Hat Enterprise Linux: 7.0
Rpm-Ostree: before 2017.3 — fixed in 2017.3
Rpm-Ostree-Client: before 2017.3 — fixed in 2017.3

How to fix

Upgrade to a fixed version: Rpm-Ostree 2017.3; Rpm-Ostree-Client 2017.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/96558
https://access.redhat.com/errata/RHSA-2017:0444
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623
http://www.securityfocus.com/bid/96558
https://access.redhat.com/errata/RHSA-2017:0444
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623

Get alerted when CVE-2017-2623 or the next vulnerability affects your stack