VULNERABILITY INTELLIGENCE

CVE-2014-0022

CVSS score5 MEDIUM
EPSS probability2.70%
CISA KEVNot currently listed
Published2014-01-26
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references