VulnerabilityModified
CVE-2014-0022
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
MEDIUM 5.0EPSS 2.41%
Does this matter?
Lower severity and a low EPSS score (2.41%). Track it; it rarely justifies an emergency change on its own.
Description
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 2.41% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- baseurl/yum
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/56637Vendor Advisory
- http://www.securityfocus.com/bid/65119
- http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
- https://bugzilla.redhat.com/show_bug.cgi?id=1052440
- https://bugzilla.redhat.com/show_bug.cgi?id=1057377
- http://secunia.com/advisories/56637Vendor Advisory
- http://www.securityfocus.com/bid/65119
- http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
- https://bugzilla.redhat.com/show_bug.cgi?id=1052440
- https://bugzilla.redhat.com/show_bug.cgi?id=1057377
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.