CVE-2014-0041: Medium severity redhat Openstack vulnerability
Grant Murphy of the Red Hat Product Security team reports:
There are a number of yum repositories configured with sslverify=false which removes SSL protections.
External reference: https://bugs.launchpad.net/heat-templates/+bug/1267635 https://github.com/openstack/heat-templates/
Other sources
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0041?
CVE-2014-0041 has been classified as a moderate severity vulnerability due to the potential exposure of SSL protections.
How do I fix CVE-2014-0041?
To mitigate CVE-2014-0041, configure your yum repositories to enable SSL verification by setting sslverify=true.
Which versions of Red Hat OpenStack are affected by CVE-2014-0041?
CVE-2014-0041 specifically affects Red Hat OpenStack version 4.0.
What risks are associated with CVE-2014-0041?
The primary risk associated with CVE-2014-0041 is the potential for man-in-the-middle attacks due to disabled SSL verification.
Is there a patch available for CVE-2014-0041?
Yes, Red Hat has issued a security advisory that includes patches to address CVE-2014-0041.