CVE-2014-0022

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-26 · updated 2026-06-17
Weakness: CWE-20

Description

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

Affected products

Baseurl Yum: through 3.4.3; 3.4.0, 3.4.1, 3.4.2

References

http://secunia.com/advisories/56637
http://www.securityfocus.com/bid/65119
http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
https://bugzilla.redhat.com/show_bug.cgi?id=1052440
https://bugzilla.redhat.com/show_bug.cgi?id=1057377
http://secunia.com/advisories/56637
http://www.securityfocus.com/bid/65119
http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
https://bugzilla.redhat.com/show_bug.cgi?id=1052440
https://bugzilla.redhat.com/show_bug.cgi?id=1057377

Get alerted when CVE-2014-0022 or the next vulnerability affects your stack