CVE-2014-0022
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly...
CVE-2014-0022 is a medium vulnerability (CVSS 5.0) in Baseurl Yum, published January 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 86th percentile. Fixed in yum-updatesd 1:0.9-6.el5_10.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.70%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:0.9-6.el5_10yum-updatesd +3 more
Description
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yum-updatesdRed Hat:enterprise_linux:5::client | before 1:0.9-6.el5_10 | 1:0.9-6.el5_10 |
yum-updatesdRed Hat:enterprise_linux:5::server | before 1:0.9-6.el5_10 | 1:0.9-6.el5_10 |
yumUbuntu:16.04:LTS | All versions, plus listed versions 3.4.3-3 | None known |
yumUbuntu:18.04:LTS | All versions, plus listed versions 3.4.3-3 | None known |
What each source reports
NVD Score used
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- Record
CVE-2014-0022- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- Record
CVE-2014-0022- Updated
- 2026-11-02
EUVDEUVD-2014-0123No score
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- Record
EUVD-2014-0123- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9cg-v6pq-9w58No score
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly...
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- Record
GHSA-f9cg-v6pq-9w58- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0022No score
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
- Record
UBUNTU-CVE-2014-0022- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/65119
yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
secunia.com/advisories/56637
bugzilla.redhat.com/show_bug.cgi?id=1052440
nvd.nist.gov/vuln/detail/CVE-2014-0022
Show 8 moreShow less
access.redhat.com/errata/RHSA-2014:1004
github.com/advisories/GHSA-f9cg-v6pq-9w58
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1004.json
cve.org/CVERecord?id=CVE-2014-0022
ubuntu.com/security/CVE-2014-0022