VDB
CVE-2017-2623
CVE-2017-2623
PUBLISHED
CVSS 5.300000190734863 MEDIUM
It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.
EPSS 1.03% · 61.1th percentile
Risk Scores
CVSS 3.0
5.300000190734863
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score
1.03%
61.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Project Atomic | rpm-ostree, | 2017.3 |
| redhat | enterprise_linux | 7.0 |
| rpm-ostree | rpm-ostree-client | 0 |
| rpm-ostree | rpm-ostree | 0 |
Timeline
- Jul 27, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Jan 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score