The Photon operating system TDNF package management tool must cryptographically verify the authenticity of all software packages during installation for all repos.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258864	PHTN-40-000199	SV-258864r1015951_rule	CCI-003992	high
Description
Installation of any nontrusted software, patches, service packs, device drivers, or operating system components can significantly affect the overall security of the operating system. This requirement ensures the software has not been tampered with and has been provided by a trusted vendor.
STIG			Date
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide			2026-06-02

Related Frameworks

2 mappings across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.2Signed Components

0.50

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-4Audit Log Storage Capacity

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-14Signed Components

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(3)Signed Components

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(5)Authorized Software — Allow-by-exception

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(5)Individual Authentication with Group Authentication

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-2Separation of System and User Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+3 more (top 10 by confidence shown)

CCI2 mappings

CCI-001749

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)

CCI-003992

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)

Details

Check Text (C-258864r1015951_chk)

At the command line, run the following command to verify software packages are cryptographically verified during installation: # grep gpgcheck /etc/yum.repos.d/* If "gpgcheck" is not set to "1" in any returned file, this is a finding.

Fix Text (F-62513r933652_fix)

Open the file where "gpgcheck" is not set to 1 with a text editor. Add or update the following line: gpgcheck=1