Vulnerability-Lookup

CVE-2024-2307 (GCVE-0-2024-2307)

Vulnerability from cvelistv5 – Published: 2024-03-19 16:16 – Updated: 2026-02-25 19:22

Title

Osbuild-composer: race condition may disable gpg verification for package repositories

Summary

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

redhat

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:2119	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2961	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-2307	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2268513	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
		Affected: 0 , < 94.0.0 (semver)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:101-1.el8 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:101-1.el9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream

Date Public

2024-03-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-19T17:28:04.933623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:13.526Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:52.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:2119",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2119"
          },
          {
            "name": "RHSA-2024:2961",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2961"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-2307"
          },
          {
            "name": "RHBZ#2268513",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268513"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/osbuild/osbuild-composer/",
          "defaultStatus": "unaffected",
          "packageName": "osbuild-composer",
          "versions": [
            {
              "lessThan": "94.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:101-1.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:101-1.el9",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2024-03-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T19:22:53.890Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:2119",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2119"
        },
        {
          "name": "RHSA-2024:2961",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2961"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-2307"
        },
        {
          "name": "RHBZ#2268513",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268513"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-07T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-03-19T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Osbuild-composer: race condition may disable gpg verification for package repositories",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-2307",
    "datePublished": "2024-03-19T16:16:31.902Z",
    "dateReserved": "2024-03-07T21:19:24.246Z",
    "dateUpdated": "2026-02-25T19:22:53.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-2307",
      "date": "2026-06-01",
      "epss": "0.00017",
      "percentile": "0.04291"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 una falla en osbuild-composer. Se puede desencadenar una condici\\u00f3n que deshabilite la verificaci\\u00f3n GPG para repositorios de paquetes, lo que puede exponer la fase de compilaci\\u00f3n a un ataque Man-in-the-Middle, permitiendo que se instale c\\u00f3digo que no es de confianza en una imagen que se est\\u00e1 compilando.\"}]",
      "id": "CVE-2024-2307",
      "lastModified": "2024-11-21T09:09:28.410",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 0.6, \"impactScore\": 5.5}]}",
      "published": "2024-03-19T17:15:12.520",
      "references": "[{\"url\": \"https://access.redhat.com/errata/RHSA-2024:2119\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2961\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-2307\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2119\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2961\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-2307\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-347\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-2307\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-03-19T17:15:12.520\",\"lastModified\":\"2024-11-21T09:09:28.410\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una falla en osbuild-composer. Se puede desencadenar una condici\u00f3n que deshabilite la verificaci\u00f3n GPG para repositorios de paquetes, lo que puede exponer la fase de compilaci\u00f3n a un ataque Man-in-the-Middle, permitiendo que se instale c\u00f3digo que no es de confianza en una imagen que se est\u00e1 compilando.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.6,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2119\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2961\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-2307\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2119\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2961\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-2307\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2024:2119\", \"name\": \"RHSA-2024:2119\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2961\", \"name\": \"RHSA-2024:2961\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-2307\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\", \"name\": \"RHBZ#2268513\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T19:11:52.858Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-2307\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-19T17:28:04.933623Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:38.144Z\"}}], \"cna\": {\"title\": \"Osbuild-composer: race condition may disable gpg verification for package repositories\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"94.0.0\", \"versionType\": \"semver\"}], \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://github.com/osbuild/osbuild-composer/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:101-1.el8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:101-1.el9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-03-07T00:00:00+00:00\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2024-03-19T00:00:00+00:00\", \"value\": \"Made public.\"}], \"datePublic\": \"2024-03-19T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2024:2119\", \"name\": \"RHSA-2024:2119\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2961\", \"name\": \"RHSA-2024:2961\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-2307\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2268513\", \"name\": \"RHBZ#2268513\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2025-11-20T18:18:14.904Z\"}, \"x_redhatCweChain\": \"CWE-362-\u003eCWE-347: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) leads to Improper Verification of Cryptographic Signature\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-2307\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-20T18:18:14.904Z\", \"dateReserved\": \"2024-03-07T21:19:24.246Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2024-03-19T16:16:31.902Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

WID-SEC-W-2024-1003

Vulnerability from csaf_certbund - Published: 2024-05-01 22:00 - Updated: 2025-04-09 22:00

Summary

Red Hat Enterprise Linux: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, Cross-Site Scripting (XSS)-Angriffe durchzuführen oder einen Men-in-the-Middle-Angriff auszuführen.

Betroffene Betriebssysteme: - Linux

CVE-2023-45803

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2024-28102

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2023-52323

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2024-22195

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2024-3019

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2023-45897

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

CVE-2024-2307

Affected products

Known affected 6 products

Product	Identifier	Version
IBM Spectrum Protect Plus <10.1.17 IBM / Spectrum Protect Plus		<10.1.17
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
Red Hat Enterprise Linux <9 Red Hat / Enterprise Linux		<9

References

37 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://access.redhat.com/errata/RHSA-2024:2119	external
https://access.redhat.com/errata/RHSA-2024:2132	external
https://access.redhat.com/errata/RHSA-2024:2437	external
https://access.redhat.com/errata/RHSA-2024:2559	external
https://access.redhat.com/errata/	external
https://linux.oracle.com/errata/ELSA-2024-2559.html	external
https://linux.oracle.com/errata/ELSA-2024-2566.html	external
https://access.redhat.com/errata/RHSA-2024:2988	external
https://access.redhat.com/errata/RHSA-2024:2968	external
https://access.redhat.com/errata/RHSA-2024:2961	external
https://access.redhat.com/errata/RHSA-2024:2952	external
https://access.redhat.com/errata/RHSA-2024:3102	external
https://access.redhat.com/errata/RHSA-2024:2987	external
https://access.redhat.com/errata/RHSA-2024:3267	external
https://access.redhat.com/errata/RHSA-2024:3264	external
https://access.redhat.com/errata/RHSA-2024:3321	external
https://access.redhat.com/errata/RHSA-2024:3322	external
https://access.redhat.com/errata/RHSA-2024:3323	external
https://access.redhat.com/errata/RHSA-2024:3324	external
https://access.redhat.com/errata/RHSA-2024:3325	external
https://linux.oracle.com/errata/ELSA-2024-2987.html	external
https://access.redhat.com/errata/RHSA-2024:3392	external
https://linux.oracle.com/errata/ELSA-2024-2961.html	external
http://linux.oracle.com/errata/ELSA-2024-3264.html	external
https://linux.oracle.com/errata/ELSA-2024-3267.html	external
https://access.redhat.com/errata/RHSA-2024:4522	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2024:11189	external
https://access.redhat.com/errata/RHSA-2024:11238	external
https://linux.oracle.com/errata/ELSA-2024-11238.html	external
https://access.redhat.com/errata/RHSA-2025:0078	external
https://access.redhat.com/errata/RHSA-2025:1793	external
https://access.redhat.com/errata/RHSA-2025:1813	external
https://alas.aws.amazon.com/AL2/ALAS-2025-2763.html	external
https://www.ibm.com/support/pages/node/7230557	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, Cross-Site Scripting (XSS)-Angriffe durchzuf\u00fchren oder einen Men-in-the-Middle-Angriff auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1003 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1003.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1003 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1003"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2024-05-01",
        "url": "https://access.redhat.com/errata/RHSA-2024:2119"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2024-05-01",
        "url": "https://access.redhat.com/errata/RHSA-2024:2132"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2024-05-01",
        "url": "https://access.redhat.com/errata/RHSA-2024:2437"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2024-05-01",
        "url": "https://access.redhat.com/errata/RHSA-2024:2559"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2024-05-01",
        "url": "https://access.redhat.com/errata/"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-2559 vom 2024-05-07",
        "url": "https://linux.oracle.com/errata/ELSA-2024-2559.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-2566 vom 2024-05-09",
        "url": "https://linux.oracle.com/errata/ELSA-2024-2566.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2988 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:2988"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2968 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:2968"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2961 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:2961"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2952 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:2952"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3102 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:3102"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2987 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:2987"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3267 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:3267"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3264 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:3264"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3321 vom 2024-05-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:3321"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3322 vom 2024-05-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:3322"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3323 vom 2024-05-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:3323"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3324 vom 2024-05-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:3324"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3325 vom 2024-05-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:3325"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-2987 vom 2024-05-28",
        "url": "https://linux.oracle.com/errata/ELSA-2024-2987.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3392 vom 2024-05-28",
        "url": "https://access.redhat.com/errata/RHSA-2024:3392"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-2961 vom 2024-05-28",
        "url": "https://linux.oracle.com/errata/ELSA-2024-2961.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-3264 vom 2024-05-30",
        "url": "http://linux.oracle.com/errata/ELSA-2024-3264.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-3267 vom 2024-06-01",
        "url": "https://linux.oracle.com/errata/ELSA-2024-3267.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4522 vom 2024-07-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:4522"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:3976-1 vom 2024-11-12",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019809.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:11189 vom 2024-12-17",
        "url": "https://access.redhat.com/errata/RHSA-2024:11189"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:11238 vom 2024-12-17",
        "url": "https://access.redhat.com/errata/RHSA-2024:11238"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-11238 vom 2024-12-19",
        "url": "https://linux.oracle.com/errata/ELSA-2024-11238.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0078 vom 2025-01-08",
        "url": "https://access.redhat.com/errata/RHSA-2025:0078"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1793 vom 2025-02-25",
        "url": "https://access.redhat.com/errata/RHSA-2025:1793"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1813 vom 2025-02-25",
        "url": "https://access.redhat.com/errata/RHSA-2025:1813"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2025-2763 vom 2025-02-25",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2025-2763.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7230557 vom 2025-04-10",
        "url": "https://www.ibm.com/support/pages/node/7230557"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Enterprise Linux: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-04-09T22:00:00.000+00:00",
      "generator": {
        "date": "2025-04-10T09:52:40.526+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2024-1003",
      "initial_release_date": "2024-05-01T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-05-01T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-05-07T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-05-09T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-05-21T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-05-22T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-05-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2024-05-30T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-02T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-07-11T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-11T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-12-16T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-12-19T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-01-07T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-02-24T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-02-25T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2025-04-09T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "16"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.1.17",
                "product": {
                  "name": "IBM Spectrum Protect Plus \u003c10.1.17",
                  "product_id": "T042730"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.17",
                "product": {
                  "name": "IBM Spectrum Protect Plus 10.1.17",
                  "product_id": "T042730-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect_plus:10.1.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect Plus"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9",
                "product": {
                  "name": "Red Hat Enterprise Linux \u003c9",
                  "product_id": "T030284"
                }
              },
              {
                "category": "product_version",
                "name": "9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "T030284-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45803",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2023-45803"
    },
    {
      "cve": "CVE-2024-28102",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2024-28102"
    },
    {
      "cve": "CVE-2023-52323",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2023-52323"
    },
    {
      "cve": "CVE-2024-22195",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2024-22195"
    },
    {
      "cve": "CVE-2024-3019",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2024-3019"
    },
    {
      "cve": "CVE-2023-45897",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2023-45897"
    },
    {
      "cve": "CVE-2024-2307",
      "product_status": {
        "known_affected": [
          "T042730",
          "T002207",
          "67646",
          "398363",
          "T004914",
          "T030284"
        ]
      },
      "release_date": "2024-05-01T22:00:00.000+00:00",
      "title": "CVE-2024-2307"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-2307 (GCVE-0-2024-2307)

WID-SEC-W-2024-1003

Tags

Sightings

Nomenclature