PT-2014-3448 · Red Hat+1 · Red Hat Enterprise Linux Openstack Platform+2

Published 2014-06-02 · Updated 2023-02-13 · CVE-2014-0041

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform version 4.0

Description The issue allows man-in-the-middle attackers to prevent updates via unspecified vectors by disabling SSL protection for certain Yum repositories.

Recommendations For Red Hat Enterprise Linux OpenStack Platform version 4.0, consider enabling SSL verification for Yum repositories to prevent man-in-the-middle attacks.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-0041

RHSA-2014:0579

Affected Products

Openstack Heat Templates

Red Hat Enterprise Linux Openstack Platform

Yum

References · 5

• http://rhn.redhat.com/errata/RHSA-2014-0579.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0041 · Security Note
• https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3CONFIRM: · Note
• https://bugs.launchpad.net/heat-templates/+bug/1267635 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1059515 · Note