CVE-2017-2623

CVE-2017-2623 describes a signature verification bypass vulnerability in rpm-ostree and rpm-ostree-client versions prior to 2017.3, affecting Red Hat Enterprise Linux and related rpm-ostree products. This medium-severity vulnerability (CVSS 5.3) allows unsigned or improperly signed packages to be accepted during layering due to insufficient GPG signature checks, potentially leading to integrity compromise (I:H). While partially mitigated by certificate pinning on RHEL Atomic Host, an attacker could exploit this remotely with high attack complexity and user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.