Skip to content
Fencer Vulns
medium 6.1

CVE-2024-2307 json

Osbuild-composer: race condition may disable gpg verification for package repositories

published 2024-03-19 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-27262

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:101-1.el8
  • Red Hat Red Hat Enterprise Linux 9 0:101-1.el9
  • osbuild-composer RHEL 8 101-1.el8
  • osbuild-composer-core RHEL 8 101-1.el8
  • osbuild-composer-worker RHEL 8 101-1.el8
  • osbuild-composer RHEL 9 101-1.el9
  • osbuild-composer-core RHEL 9 101-1.el9
  • osbuild-composer-worker RHEL 9 101-1.el9

red hat advisories RHSA-2024:2961RHSA-2024:2119

  • osbuild-composer AlmaLinux 8 101-1.el8.alma.1
  • osbuild-composer-core AlmaLinux 8 101-1.el8.alma.1
  • osbuild-composer-worker AlmaLinux 8 101-1.el8.alma.1
  • osbuild-composer AlmaLinux 9 101-1.el9.alma.1
  • osbuild-composer-core AlmaLinux 9 101-1.el9.alma.1
  • osbuild-composer-worker AlmaLinux 9 101-1.el9.alma.1

almalinux advisories ALSA-2024:2961ALSA-2024:2119

  • osbuild Rocky Linux 8 110-1.el8.rocky.0.2
  • osbuild-composer Rocky Linux 8 101-1.el8.rocky.0.4

rocky linux advisories RLSA-2024:2961

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-2307 updated cvss 6.1

osbuild-composer: race condition may disable GPG verification for package repositories

  • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer 101-1.el8, osbuild-composer-core 101-1.el8, osbuild-composer-worker 101-1.el8
    fixed: vendor fix RHSA-2024:2961
  • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer 101-1.el9, osbuild-composer-core 101-1.el9, osbuild-composer-worker 101-1.el9
    fixed: vendor fix RHSA-2024:2119
  • Red Hat Enterprise Linux AppStream (v. 8) osbuild 110-1.el8, osbuild-lvm2 110-1.el8, osbuild-luks2 110-1.el8, osbuild-ostree 110-1.el8, osbuild-selinux 110-1.el8, python3-osbuild 110-1.el8, +1 more Red Hat Enterprise Linux AppStream (v. 9) osbuild 110-1.el9, osbuild-lvm2 110-1.el9, osbuild-luks2 110-1.el9, osbuild-ostree 110-1.el9, osbuild-selinux 110-1.el9, python3-osbuild 110-1.el9, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.