CVE-2014-0022

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-00237.8OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution CVE-2014-00266.5katello-headpin is vulnerable to CSRF in REST API CVE-2014-00273.3The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tm CVE-2014-00284.3libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs CVE-2014-00296.1Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject a CVE-2014-00309.8The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vec CVE-2014-00314.0The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network A CVE-2014-00324.3The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParent CVE-2014-00334.3org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting wh CVE-2014-00344.3The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is ena CVE-2014-00354.3The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy CVE-2014-00366.8The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man