CVE-2024-2307

Name of the Vulnerable Software and Affected Versions osbuild-composer (affected versions not specified)

Description A flaw in osbuild-composer can trigger a condition that disables GPG verification for package repositories. This can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built. The issue is related to incorrect cryptographic signature verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.