cve/2024/CVE-2024-2307.md

CVE-2024-2307

Description

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

POC

Reference

• https://bugzilla.redhat.com/show_bug.cgi?id=2268513
• https://bugzilla.redhat.com/show_bug.cgi?id=2268513

Github

• https://github.com/NaInSec/CVE-LIST
• https://github.com/fkie-cad/nvd-json-data-feeds