STIGQter STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-248574r1015031_rule

Vulnerability Number

V-248574

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

OL08-00-010370

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure OL 8 to verify the signature of packages from a repository prior to install by setting the following option in the "/etc/yum.repos.d/[your_repo_name].repo" file:

gpgcheck=1

Check Contents

Check that YUM verifies the signature of packages from a repository prior to install with the following command:

$ sudo grep gpgcheck /etc/yum.repos.d/*.repo

gpgcheck=1

If "gpgcheck" is not set to "1", or if options are missing or commented out, ask the system administrator (SA) how the certificates for patches and other operating system components are verified.

If there is no process to validate certificates that is approved by the organization, this is a finding.

Vulnerability Number

V-248574

Documentable

False

Rule Version

OL08-00-010370

Severity Override Guidance

Check that YUM verifies the signature of packages from a repository prior to install with the following command:

$ sudo grep gpgcheck /etc/yum.repos.d/*.repo

gpgcheck=1

If "gpgcheck" is not set to "1", or if options are missing or commented out, ask the system administrator (SA) how the certificates for patches and other operating system components are verified.

If there is no process to validate certificates that is approved by the organization, this is a finding.

Check Content Reference

M

Target Key

5416