CVEvulnerability
CVE-2014-0022
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-01-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
Affected configurations
• baseurl yum (<= 3.4.3)
• baseurl yum 3.4.0
• baseurl yum 3.4.1
• baseurl yum 3.4.2
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://secunia.com/advisories/56637 Vendor Advisory
- http://www.securityfocus.com/bid/65119 www.securityfocus.com
- http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794 yum.baseurl.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1052440 bugzilla.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1057377 bugzilla.redhat.com
- http://secunia.com/advisories/56637 Vendor Advisory
- http://www.securityfocus.com/bid/65119 www.securityfocus.com
- http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794 yum.baseurl.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1052440 bugzilla.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1057377 bugzilla.redhat.com