Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Red Hat: RHSA-2017:0444-02 Moderate: rpm-ostree GPG Signature Flaw

red hat
Calendar Grey March 3, 2017
Scroller Redhat
Cautious security advisory regarding rpm-ostree enhancements and GPG validation concerns for Red Hat Atomic Host.
An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system trees. It provides commands which can be used both on client systems as well as server-side composes. The rpm-ostree-client package provides commands usable on client systems to upgrade and rollback.
The following packages have been upgraded to a later upstream version: rpm-ostree (2017.1), rpm-ostree-client (2017.1). (BZ#1416089)
Security Fix(es):
* It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default. (CVE-2017-2623)
This issue was discovered by Colin Walters (Red Hat).

Topics%20covered

Topics Covered

security advisory Red Hat update moderate severity GPG signature client application rpm-ostree

References

https://access.redhat.com/security/cve/CVE-2017-2623 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux Atomic Host 7:
Source: rpm-ostree-2017.1-5.atomic.el7.src.rpm rpm-ostree-client-2017.1-6.atomic.el7.src.rpm
x86_64: rpm-ostree-2017.1-5.atomic.el7.x86_64.rpm rpm-ostree-client-2017.1-6.atomic.el7.x86_64.rpm rpm-ostree-client-debuginfo-2017.1-6.atomic.el7.x86_64.rpm rpm-ostree-debuginfo-2017.1-5.atomic.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2017:0444-02
Product: Red Hat Enterprise Linux Atomic Host
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0444
Issue date: 2017-03-02

Topic

An update for rpm-ostree and rpm-ostree-client is now available for Red HatEnterprise Linux Atomic Host 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat update moderate severity GPG signature client application rpm-ostree

Relevant Releases Architectures

Red Hat Enterprise Linux Atomic Host 7 - x86_64

Bugs Fixed

1416089 - Rebase ostree + rpm-ostree for 7.3.3

1421781 - Package layering non-root packages does not install var paths owned by root

1421867 - rpm-ostree daemon does not start when system is unsubscribed

1422157 - CVE-2017-2623 rpm-ostree and rpm-ostree-client fail to check gpg package signatures when layering

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.