Medium severity6.1NVD Advisory· Published Mar 19, 2024· Updated Apr 15, 2026

CVE-2024-2307

Description

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Osbuild/Osbuild Composerinferred2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)
osv-coords3 versions
pkg:rpm/almalinux/osbuild-composer pkg:rpm/almalinux/osbuild-composer-core pkg:rpm/almalinux/osbuild-composer-worker
< 101-1.el9.alma.1+ 2 more
- (no CPE)range: < 101-1.el9.alma.1
- (no CPE)range: < 101-1.el9.alma.1
- (no CPE)range: < 101-1.el9.alma.1

Patches

Vulnerability mechanics

References

access.redhat.com/errata/RHSA-2024:2119nvd
access.redhat.com/errata/RHSA-2024:2961nvd
access.redhat.com/security/cve/CVE-2024-2307nvd
bugzilla.redhat.com/show_bug.cginvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000