{"id":"CVE-2024-2307","aliases":["ALSA-2024:2119","ALSA-2024:2961","EUVD-2024-27262","GHSA-64jx-m9pq-gr8c","RHSA-2024:2119","RHSA-2024:2961","RLSA-2024:2961"],"status":"published","title":"Osbuild-composer: race condition may disable gpg verification for package repositories","description":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00188,"percentile":0.08412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2024-03-19T16:16:31Z","modified":"2026-10-29T11:31:04Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"osbuild-composer","fixed_in":["101-1.el9.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"osbuild-composer-core","fixed_in":["101-1.el9.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"osbuild-composer-worker","fixed_in":["101-1.el9.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"osbuild-composer","fixed_in":["101-1.el8.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"osbuild-composer-core","fixed_in":["101-1.el8.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"osbuild-composer-worker","fixed_in":["101-1.el8.alma.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","fixed_in":["0:101-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core-debuginfo","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debuginfo","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debugsource","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-tests-debuginfo","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker-debuginfo","fixed_in":["0:101-1.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"osbuild","fixed_in":["0:110-1.el8.rocky.0.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"osbuild-composer","fixed_in":["0:101-1.el8.rocky.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el9.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el9.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el9.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el8.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el8.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101-1.el8.alma.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"osbuild","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:110-1.el8.rocky.0.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101-1.el8.rocky.0.4"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2119","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2961","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2307","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268513","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2307","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-64jx-m9pq-gr8c"},{"url":"https://bugzilla.redhat.com/2268513","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2119.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-2961.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-1035","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2119.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2307","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-1770","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2961.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2961","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2307","title":"Osbuild-composer: race condition may disable gpg verification for package repositories","description":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.","status":"published","published":"2024-03-19T16:16:31.902Z","modified":"2026-02-25T19:22:53.89Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-27262","description":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.","status":"published","published":"2024-03-19T16:16:31Z","modified":"2026-02-25T19:22:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:28.530473Z"}],"ghsa":[{"id":"GHSA-64jx-m9pq-gr8c","title":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification...","description":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.","status":"published","published":"2024-03-19T18:32:02Z","modified":"2024-05-22T18:30:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:57:23.839378Z"}],"nvd":[{"id":"CVE-2024-2307","description":"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.","status":"published","published":"2024-03-19T17:15:12.52Z","modified":"2026-06-17T07:24:17.03Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"RHSA-2024:2119","title":"Red Hat Security Advisory: Image builder components bug fix, enhancement and security update","status":"published","published":"2024-09-16T13:00:33Z","modified":"2026-03-18T11:35:03.557141Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2961","title":"Red Hat Security Advisory: Image builder components bug fix, enhancement and security update","status":"published","published":"2024-09-16T13:00:44Z","modified":"2026-03-18T11:35:07.778684Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"ALSA-2024:2119","title":"Moderate: Image builder components bug fix, enhancement and security update","description":"Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:04.993817883Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2961","title":"Moderate: Image builder components bug fix, enhancement and security update","description":"Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.52442365Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"RLSA-2024:2961","title":"Moderate: Image builder components bug fix, enhancement and security update","description":"Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* osbuild-composer: race condition may disable GPG verification for package repositories (CVE-2024-2307)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-04T09:45:06.067484Z","updated_at":"2026-11-02T15:53:24.63379Z"}]}}