CVE-2024-2307 — Osbuild-composer: race condition may disable gpg verification for package repositories
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Midd…
Published: 2024-03-19 · CVSS: 6.1 · CVSS 3.1
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7