Default credentials

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certifica...

CVE-2017-2623

The CVE-2017-2623 issue affects rpm-ostree and rpm-ostree-client older than 2017.3, where GPG signatures on layered packages were not checked properly. This could allow unsigned or poorly signed content to be accepted instead of rejected. The severity and impact are described in multiple sources ...

Updated flatpak packages fix security vulnerability

Updated flatpak packages fix security vulnerability: A sandbox escape in the flatpak dbus proxy in the authentication phase CVE-2018-6560. The flatpak has been upgraded to the latest stable version, 0.10.3, which fixes this issue. The bubblewrap, ostree, flatpak-builder, xdg-desktop-portal,...

Fedora 24 : rpm-ostree (2017-788129b61c)

https://github.com/projectatomic/rpm-ostree/releases/tag/v2017.3 This release includes a fix for CVE-2017-2623. There are a few new features, such as systemctl reload rpm-ostreed now being supported. Some bugfixes such as memory leak fixes. Besides that, there's a lot of internal refactoring goin...

[SECURITY] Fedora 25 Update: rpm-ostree-2017.3-2.fc25

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

[SECURITY] Fedora 24 Update: rpm-ostree-2017.3-2.fc24

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

Fedora 25 : rpm-ostree (2017-003fa5648c)

https://github.com/projectatomic/rpm-ostree/releases/tag/v2017.3 This release includes a fix for CVE-2017-2623. There are a few new features, such as systemctl reload rpm-ostreed now being supported. Some bugfixes such as memory leak fixes. Besides that, there's a lot of internal refactoring goin...

Fedora Update for rpm-ostree FEDORA-2017-003fa5648c

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for rpm-ostree FEDORA-2017-788129b61c

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : rpm-ostree and rpm-ostree-client (RHSA-2017:0444)

An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2017-2623

It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is...

Moderate: Red Hat Security Advisory: rpm-ostree and rpm-ostree-client security, bug fix, and enhancement update

An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

rpm-ostree-client: fails to check gpg package signatures when layering

It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is...

Fedora Update for pulp-ostree FEDORA-2016-4373f7d32a

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)

2.8.6 is a security and bugfix release. Included in the list of fixed issues in 2.8.5 are two CVEs : - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed Several issues with database migrations are also addressed in this...

[SECURITY] Fedora 24 Update: pulp-ostree-1.1.2-1.fc24

Provides a collection of platform plugins and client extensions support for OSTree content...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-f9db2293a8)

Update to Pulp 2.8.3, a security and bugfix update. ---- - CVE-2016-3111: Protect the RSA keys during and after install 1325693. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Fedora Update for pulp-ostree FEDORA-2016-f9db2293a8

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: pulp-ostree-1.1.1-1.fc24

Provides a collection of platform plugins and client extensions support for OSTree content...

Fedora 19 : python-rhsm-1.13.6-1.fc19 (2014-13794)

New features : - Send list of compliance reasons on dbus - Added client-side support for --matches on the list command. Security : - 1153375: Support TLSv1.2 and v1.1 by default. CVE-2014-3566 Bug fixes : - 1120772: Don't traceback on missing /ostree/repo - 1094747: add appdata metdata file -...