Description
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
osbuild-composer
Default version status: unaffected
0 to < 94.0.0affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
0:101-1.el8 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
0:101-1.el9 to < *unaffected