Bug 860255 (CVE-2014-0022) - VUL-0: CVE-2014-0022: yum: yum-cron installs unsigned packages
Summary: VUL-0: CVE-2014-0022: yum: yum-cron installs unsigned packages
Status: RESOLVED INVALID
Alias: CVE-2014-0022
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Vincent Untz
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-24 08:29 UTC by Alexander Bergmann
Modified: 2014-07-01 14:49 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-01-24 08:29:22 UTC 
CVE-2014-0022

Gabriel VLASIU reported that yum-cron would install unsigned RPM packages that yum itself would refuse to install.  The yum-cron code is based on that in yum-updatesd.py.  This is due to  the installUpdates() function (processPkgs() in yum-updatesd.py) failing to fully check the return code of the called sigCheckPkg() function.  sigCheckPkg() is described thus:

See all details inside the RedHat bug [1].

References:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1057377
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0022
https://bugzilla.redhat.com/show_bug.cgi?id=1052440
http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e579496ccb6df5c3f5b5b7bab8d648b06b4
http://comments.gmane.org/gmane.comp.security.oss.general/11927
Comment 3 Michael Calmer 2014-01-24 12:21:11 UTC 
Just a small analysis.

Our yum does not have yum-cron.py, but the yum-updatesd.py which is effected.
But this file is in the subpackage "yum-updatesd" which is not shipped anywhere.

Does it make sense to provide an update we do not need to ship?
Comment 4 Michael Calmer 2014-01-24 12:21:55 UTC 
This is about yum on SLES11. I don't know if we have yum on openSUSE.
Comment 5 Swamp Workflow Management 2014-01-24 23:00:18 UTC 
bugbot adjusting priority
Comment 6 Sebastian Krahmer 2014-01-27 09:00:46 UTC 
Seems we have it on opensuse. If we dont ship the vulnerable
code on SLE, its sufficient to fix in Factory there.
Comment 7 Marcus Meissner 2014-07-01 14:49:40 UTC 
we do not ship the python yum-cron in our yum packages.