CVE-2024-2307
Osbuild-composer: race condition may disable gpg verification for package repositories
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Osbuild-composer: race condition may disable gpg verification for package repositories
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
- Record
CVE-2024-2307- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2024-27262
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
- Record
EUVD-2024-27262- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-64jx-m9pq-gr8c
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification...
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
- Record
GHSA-64jx-m9pq-gr8c- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
- Record
CVE-2024-2307- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVRHSA-2024:2119
Red Hat Security Advisory: Image builder components bug fix, enhancement and security update
- Record
RHSA-2024:2119- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2024:2961
Red Hat Security Advisory: Image builder components bug fix, enhancement and security update
- Record
RHSA-2024:2961- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVALSA-2024:2119 No score
Moderate: Image builder components bug fix, enhancement and security update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.
Security Fix(es):
- osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:2119- Updated
- 2026-11-02
OSVALSA-2024:2961 No score
Moderate: Image builder components bug fix, enhancement and security update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.
Security Fix(es):
- osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:2961- Updated
- 2026-11-02
OSVRLSA-2024:2961 No score
Moderate: Image builder components bug fix, enhancement and security update
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.
Security Fix(es):
- osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.
- Record
RLSA-2024:2961- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
osbuild-composerAlmaLinux:9 |
before 101-1.el9.alma.1 | 101-1.el9.alma.1 |
osbuild-composer-coreAlmaLinux:9 |
before 101-1.el9.alma.1 | 101-1.el9.alma.1 |
osbuild-composer-workerAlmaLinux:9 |
before 101-1.el9.alma.1 | 101-1.el9.alma.1 |
osbuild-composerAlmaLinux:8 |
before 101-1.el8.alma.1 | 101-1.el8.alma.1 |
osbuild-composer-coreAlmaLinux:8 |
before 101-1.el8.alma.1 | 101-1.el8.alma.1 |
osbuild-composer-workerAlmaLinux:8 |
before 101-1.el8.alma.1 | 101-1.el8.alma.1 |
osbuild-composerRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-coreRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-core-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
osbuild-composer-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-tests-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-workerRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composer-worker-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:101-1.el9 | 0:101-1.el9 |
osbuild-composerRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-coreRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-core-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-tests-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-workerRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuild-composer-worker-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:101-1.el8 | 0:101-1.el8 |
osbuildRocky Linux:8 |
before 0:110-1.el8.rocky.0.2 | 0:110-1.el8.rocky.0.2 |
osbuild-composerRocky Linux:8 |
before 0:101-1.el8.rocky.0.4 | 0:101-1.el8.rocky.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2307 is a medium vulnerability (CVSS 6.1) in Red Hat Enterprise Linux 8, published March 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in osbuild-composer 101-1.el9.alma.1.
References
access.redhat.com/errata/RHSA-2024:2119
bugzilla.redhat.com/show_bug.cgi?id=2268513
nvd.nist.gov/vuln/detail/CVE-2024-2307
github.com/advisories/GHSA-64jx-m9pq-gr8c
Show 12 moreShow less
errata.almalinux.org/9/ALSA-2024-2119.html
issues.redhat.com/browse/RHEL-1035
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2119.json
cve.org/CVERecord?id=CVE-2024-2307
errata.rockylinux.org/RLSA-2024:2961