PT-2014-3447 · Red Hat+1 · Red Hat Enterprise Linux Openstack Platform+2

CVE-2014-0040 · Publicado 2014-06-02 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform version 4.0

Description The issue allows man-in-the-middle attackers to prevent updates via unspecified vectors, as OpenStack Heat Templates uses an HTTP connection to download packages and signing keys from Yum repositories.

Recommendations For Red Hat Enterprise Linux OpenStack Platform version 4.0, consider switching to HTTPS connections for downloading packages and signing keys from Yum repositories to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the Yum repositories to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2014-0040

RHSA-2014:0579

Produtos afetados

Openstack Heat Templates

Red Hat Enterprise Linux Openstack Platform

Yum

Referências · 5

• 🔥 https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 · Exploit
• https://bugs.launchpad.net/heat-templates/+bug/1267635 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0579.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1059514 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0040 · Nota de Segurança