[RHSA-2017:0444-02] Moderate: rpm-ostree and rpm-ostree-client security, bug fix, and enhancement update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: rpm-ostree and rpm-ostree-client security, bug fix, and enhancement update

Advisory ID: RHSA-2017:0444-02

Product: Red Hat Enterprise Linux Atomic Host

Advisory URL: https://access.redhat.com/errata/RHSA-2017:0444

Issue date: 2017-03-02

CVE Names: CVE-2017-2623

=====================================================================

 

1. Summary:

 

An update for rpm-ostree and rpm-ostree-client is now available for Red Hat

Enterprise Linux Atomic Host 7.

 

Red Hat Product Security has rated this update as having a security impact

of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available for each vulnerability from

the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Atomic Host 7 - x86_64

 

3. Description:

 

The rpm-ostree tool binds together the RPM packaging model with the OSTree

model of bootable file system trees. It provides commands which can be used

both on client systems as well as server-side composes. The

rpm-ostree-client package provides commands usable on client systems to

upgrade and rollback.

 

The following packages have been upgraded to a later upstream version:

rpm-ostree (2017.1), rpm-ostree-client (2017.1). (BZ#1416089)

 

Security Fix(es):

 

* It was discovered that rpm-ostree and rpm-ostree-client fail to properly

check GPG signatures on packages when doing layering. Packages with

unsigned or badly signed content could fail to be rejected as expected.

This issue is partially mitigated on RHEL Atomic Host, where certificate

pinning is used by default. (CVE-2017-2623)

 

This issue was discovered by Colin Walters (Red Hat).

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1416089 - Rebase ostree + rpm-ostree for 7.3.3

1421781 - Package layering non-root packages does not install var paths owned by root

1421867 - rpm-ostree daemon does not start when system is unsubscribed

1422157 - CVE-2017-2623 rpm-ostree and rpm-ostree-client fail to check gpg package signatures when layering

 

6. Package List:

 

Red Hat Enterprise Linux Atomic Host 7:

 

Source:

rpm-ostree-2017.1-5.atomic.el7.src.rpm

rpm-ostree-client-2017.1-6.atomic.el7.src.rpm

 

x86_64:

rpm-ostree-2017.1-5.atomic.el7.x86_64.rpm

rpm-ostree-client-2017.1-6.atomic.el7.x86_64.rpm

rpm-ostree-client-debuginfo-2017.1-6.atomic.el7.x86_64.rpm

rpm-ostree-debuginfo-2017.1-5.atomic.el7.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2017-2623

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2017 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFYua6VXlSAg2UNWIIRArH9AKC6iEqsWOpD4fnaGUOv/+lX/lA+hwCgrhqf

MiRkWlUViSI8bMY3ORUT38k=

=iyES

-----END PGP SIGNATURE-----

 

 

--