Unscored severity · published Jan 26, 2014
CVE-2014-0022
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YU
Yum · Baseurl
through 3.4.3; 3.4.0; 3.4.1; 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0022
Vendor Advisory
http://secunia.com/advisories/56637
www.securityfocus.com
http://www.securityfocus.com/bid/65119
yum.baseurl.org
http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1052440
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1057377
More from Yum
9.8
CVE-2013-1910
yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata…