Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-2307
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Osbuild-composer: race condition may disable gpg verification for package repositories
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
osbuild-composer 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
osbuild-composer是osbuild的一组用于编写操作系统映像的 HTTP 服务。 osbuild-composer存在数据伪造问题漏洞，该漏洞源于可以触发禁用包存储库的GPG验证条件，可能会遭受中间人攻击，从而允许将不受信任的代码安装到正在构建的映像中。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
Red HatRed Hat Enterprise Linux 8 0:101-1.el8 ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red HatRed Hat Enterprise Linux 9 0:101-1.el9 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
II. Public POCs for CVE-2024-2307
#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2024-2307
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same weakness: CWE-347
V. Comments for CVE-2024-2307

No comments yet

Leave a comment