CVE-2014-0022 | BDVDB-2026-59624 Detail

Description#

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/65119
http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
http://secunia.com/advisories/56637
https://bugzilla.redhat.com/show_bug.cgi?id=1052440
https://bugzilla.redhat.com/show_bug.cgi?id=1057377

Exploit#

No public exploit known

History#

Version 12014-01-26Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.