CVE-2014-0040: Medium severity redhat Openstack vulnerability
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Other sources
There are a number of yum repositories that make connections via http (should be https). Also, signing keys can be downloaded over http instead of https.
External reference: https://bugs.launchpad.net/heat-templates/+bug/1267635 https://github.com/openstack/heat-templates/
Acknowledgements:
This issue was discovered by Grant Murphy of the Red Hat Product Security Team.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0040?
CVE-2014-0040 is considered a medium severity vulnerability due to its potential impact on system updates.
How do I fix CVE-2014-0040?
To mitigate CVE-2014-0040, it is recommended to switch to secure HTTPS connections when downloading packages and signing keys.
What types of attacks can exploit CVE-2014-0040?
CVE-2014-0040 can be exploited by man-in-the-middle attackers who can intercept HTTP connections to Yum repositories.
Which software is affected by CVE-2014-0040?
CVE-2014-0040 affects Red Hat Enterprise Linux OpenStack Platform 4.0 and its heat-templates.
When was CVE-2014-0040 disclosed?
CVE-2014-0040 was disclosed in 2014 and is part of the vulnerabilities affecting OpenStack Heat.