{"cve":"CVE-2017-2623","nvd":{"published":"2018-07-27T18:29:00.767","modified":"2026-06-17T01:16:31.983","status":"Modified","description":"It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.3},"cwes":["CWE-295"],"references":["http://www.securityfocus.com/bid/96558","https://access.redhat.com/errata/RHSA-2017:0444","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623","http://www.securityfocus.com/bid/96558","https://access.redhat.com/errata/RHSA-2017:0444"],"products":["redhat:enterprise_linux","rpm-ostree:rpm-ostree","rpm-ostree:rpm-ostree-client"],"source":"nvd","synced_at":"2026-10-19T20:52:03.425131697+00:00"},"epss":{"cve":"CVE-2017-2623","score":0.01013,"percentile":0.63246,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}