CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
Percentile
78.5%
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and
earlier does not properly check the return value of the sigCheckPkg
function, which allows remote attackers to bypass the RMP package signing
restriction via an unsigned package.
secunia.com/advisories/56637
yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794
bugzilla.redhat.com/show_bug.cgi?id=1052440
bugzilla.redhat.com/show_bug.cgi?id=1057377
launchpad.net/bugs/cve/CVE-2014-0022
nvd.nist.gov/vuln/detail/CVE-2014-0022
security-tracker.debian.org/tracker/CVE-2014-0022
www.cve.org/CVERecord?id=CVE-2014-0022