« Volver al listado

CVE-2014-0022

Estado: ModificadaMedia (5)—

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Baseurl — YUM

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0022",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-26T16:58:11.197",
  "references": [
    {
      "url": "http://secunia.com/advisories/56637",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/65119",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052440",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1057377",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/56637",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/65119",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052440",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1057377",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package."
    },
    {
      "lang": "es",
      "value": "La función installUpdates en yum-cron/yum-cron.py en yum 3.4.3 y anteriores no chequea apropiadamente el valor de retorno de la función sigCheckPkg, lo cual permite a atacantes remotos sortear la restricción de firmado de paquetes RMP a través de un paquete no firmado."
    }
  ],
  "lastModified": "2026-06-17T00:02:06.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:baseurl:yum:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BEBBA1D-0651-459D-98CA-F3215397E869",
              "versionEndIncluding": "3.4.3"
            },
            {
              "criteria": "cpe:2.3:a:baseurl:yum:3.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5484C2BC-A606-4537-84F7-9203499E3E93"
            },
            {
              "criteria": "cpe:2.3:a:baseurl:yum:3.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10E52FC3-4ACA-450D-B5C7-1F153A569F31"
            },
            {
              "criteria": "cpe:2.3:a:baseurl:yum:3.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BFDAC89-4838-4079-B6C9-0832F6ADCA9F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}