CVE-2014-0042: Medium severity redhat Openstack vulnerability
Grant Murphy of the Red Hat Product Security team reports:
there are a number of yum repositories that are configured with gpgcheck=0 but have rpms that are signed (e.g. Jenkins).
External reference: https://bugs.launchpad.net/heat-templates/+bug/1267635 https://github.com/openstack/heat-templates/
Other sources
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0042?
CVE-2014-0042 is classified as a moderate severity vulnerability due to the risks it poses in repository configurations.
How do I fix CVE-2014-0042?
To fix CVE-2014-0042, change the yum repository configuration to set gpgcheck=1 for signed RPMs.
What systems are affected by CVE-2014-0042?
CVE-2014-0042 affects Red Hat OpenStack version 4.0 and other systems using improperly configured yum repositories.
What are the implications of CVE-2014-0042?
The implications of CVE-2014-0042 may include the installation of malicious RPMs if proper checks are not in place.
Is there a patch available for CVE-2014-0042?
Yes, a patch is available in recent updates for Red Hat OpenStack to address CVE-2014-0042.