CVE-2024-2307: Red Hat Enterprise Linux 8

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.

Affected products

• Red Hat Red Hat Enterprise Linux 8: before 0:101-1.el8 (fixed in 0:101-1.el8)
• Red Hat Red Hat Enterprise Linux 9: before 0:101-1.el9 (fixed in 0:101-1.el9)

Published 2024-03-19. Last modified 2026-06-17.