CVE-2014-0022

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly...

5.0 MediumFix available

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.

Exploit likelihood

2.70%Up 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2014-0022
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0022
Updated: 2026-11-02

EUVDEUVD-2014-0123 No score

Record: EUVD-2014-0123
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f9cg-v6pq-9w58 No score

The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly...

Record: GHSA-f9cg-v6pq-9w58
Weakness: CWE-20
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-0022 No score

Record: UBUNTU-CVE-2014-0022
Updated: 2026-11-02

Affected products

baseurl yum

Affected packages

Affected packages
Package	Affected	Fixed
`yum-updatesd` Red Hat:enterprise_linux:5::client	before 1:0.9-6.el5_10	1:0.9-6.el5_10
`yum-updatesd` Red Hat:enterprise_linux:5::server	before 1:0.9-6.el5_10	1:0.9-6.el5_10
`yum` Ubuntu:16.04:LTS	All versions, plus listed versions 3.4.3-3	None known
`yum` Ubuntu:18.04:LTS	All versions, plus listed versions 3.4.3-3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0022 is a medium vulnerability (CVSS 5.0) in Baseurl Yum, published January 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 85th percentile. Fixed in yum-updatesd 1:0.9-6.el5_10.

References

Show 8 moreShow less