CVE-2015-3229: Medium severity fedora project kickstarts vulnerability
fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic updates.
Other sources
It was reported that Fedora Atomic updates are trivially vulnerable to a MITM attack.
Upstream fix: https://git.fedorahosted.org/cgit/spin-kickstarts.git/commit/?id=1e408e111008f539c89212a9ca9bb955e2c4f823 Original report: https://bugzilla.redhat.com/showbug.cgi?id=1231287
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3229?
CVE-2015-3229 is considered a moderate severity vulnerability due to its potential for man-in-the-middle attacks.
How does CVE-2015-3229 affect Fedora Atomic updates?
CVE-2015-3229 allows remote attackers to intercept and alter Fedora Atomic updates due to the insecure use of HTTP.
What steps can I take to mitigate CVE-2015-3229?
To mitigate CVE-2015-3229, configure the system to use HTTPS instead of HTTP for downloading updates.
Is there a patch available for CVE-2015-3229?
Yes, an upstream fix for CVE-2015-3229 has been developed and made available.
Which software versions are affected by CVE-2015-3229?
CVE-2015-3229 affects the spin-kickstarts related to Fedora Atomic updates.