PT-2014-3447 · Red Hat+1 · Red Hat Enterprise Linux Openstack Platform+2

Published 2014-06-02 · Updated 2023-02-13 · CVE-2014-0040

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform version 4.0

Description The issue allows man-in-the-middle attackers to prevent updates via unspecified vectors, as OpenStack Heat Templates uses an HTTP connection to download packages and signing keys from Yum repositories.

Recommendations For Red Hat Enterprise Linux OpenStack Platform version 4.0, consider switching to HTTPS connections for downloading packages and signing keys from Yum repositories to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the Yum repositories to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2014-0040

RHSA-2014:0579

Affected Products

Openstack Heat Templates

Red Hat Enterprise Linux Openstack Platform

Yum

References · 5

• 🔥 https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 · Exploit
• http://rhn.redhat.com/errata/RHSA-2014-0579.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0040 · Security Note
• https://bugs.launchpad.net/heat-templates/+bug/1267635 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1059514 · Note