CVE-2017-2623 Security feature bypass in rpm-ostree,

Medium 5.3 Published 27 Jul 2018 Updated 5 Aug 2024

Attackers can bypass GPG signature checks to install unsigned or malicious packages via rpm-ostree layering, potentially leading to code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-2623?

CVE-2017-2623 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 27 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

Weakness: CWE-295

Which versions are affected by CVE-2017-2623?

It affects 3 products.

Linux distribution packages (4)

`rpm-ostree` Red Hat:rhel_atomic:7	All versions	`0:2017.1-5.atomic.el7`
`rpm-ostree-client` Red Hat:rhel_atomic:7	All versions	`0:2017.1-6.atomic.el7`
`rpm-ostree-client-debuginfo` Red Hat:rhel_atomic:7	All versions	`0:2017.1-6.atomic.el7`
`rpm-ostree-debuginfo` Red Hat:rhel_atomic:7	All versions	`0:2017.1-5.atomic.el7`

Products include Redhat Enterprise Linux, Rpm-Ostree Rpm-Ostree, Rpm-Ostree Rpm-Ostree-Client.

How do I fix CVE-2017-2623?

Upgrade to a fixed version.

Is CVE-2017-2623 being exploited?

There is no known exploitation of CVE-2017-2623 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as GHSA-v473-h83f-x76x, RHSA-2017:0444.