CVE-2014-0022 The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP packa...
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| baseurl yum | <= 3.4.3 | No fix listed |
| baseurl yum | = 3.4.0 | No fix listed |
| baseurl yum | = 3.4.1 | No fix listed |
| baseurl yum | = 3.4.2 | No fix listed |
References
- 56637 third-party-advisory vendor-advisory
- 65119 vdb-entry
- yum.baseurl.org
- bugzilla.redhat.com
- bugzilla.redhat.com