Supply Chain Attack - Lock Files In osbuild-composer
Description
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel9 | 0:101-1.el9 | ||
rpm rhel8 | 0:101-1.el8 |
Aliases
1. 2. 3.