Lucene search

Ubuntu.comUB:CVE-2014-0022

HistoryJan 26, 2014 - 12:00 a.m.

CVE-2014-0022

2014-01-2600:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.006

Percentile

78.5%

JSON

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and
earlier does not properly check the return value of the sigCheckPkg
function, which allows remote attackers to bypass the RMP package signing
restriction via an unsigned package.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchyum< anyUNKNOWN
ubuntu16.04noarchyum< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	yum	< any	UNKNOWN
ubuntu	16.04	noarch	yum	< any	UNKNOWN

References

secunia.com/advisories/56637

yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794

bugzilla.redhat.com/show_bug.cgi?id=1052440

bugzilla.redhat.com/show_bug.cgi?id=1057377

launchpad.net/bugs/cve/CVE-2014-0022

nvd.nist.gov/vuln/detail/CVE-2014-0022

security-tracker.debian.org/tracker/CVE-2014-0022

www.cve.org/CVERecord?id=CVE-2014-0022

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.006

Percentile

78.5%

JSON

Related for UB:CVE-2014-0022