CVE-2014-0040: Insufficient Information (NVD-CWE-noinfo)
value: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-06-02T15:55Z
Repository: https://github.com/openstack/heat-templates
Language: YAML
Files changed: openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker, openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node, openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml, openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml, openshift-origin/centos65/OpenShift-1B1N.yaml, openshift-origin/centos65/OpenShift.yaml
Commit date: 2014-04-04 13:20:00 -0400
Commit message: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7

Diff: diff --git a/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker b/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
index 82c0c42..7d441c1 100755
--- a/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
+++ b/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
@@ -10,45 +10,41 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
   cat > /etc/yum.repos.d/openshift-client.repo <<YUM
 [openshift_client]
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/Client/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat > /etc/yum.repos.d/openshift-infrastructure.repo <<YUM
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/Infrastructure/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
   fi
 else
   if [ -n "${DIB_CONF_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/openshift.repo
 [openshift_client]
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-CLIENT-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-INFRA-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 YUM
   fi
 fi
 
diff --git a/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node b/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
index f7981ad..4350747 100755
--- a/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
+++ b/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
@@ -10,76 +10,72 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
   cat > /etc/yum.repos.d/openshift-node.repo <<YUM
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/Node/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat > /etc/yum.repos.d/openshift-jboss.repo <<YUM
 [openshift_jbosseap]
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/JBoss_EAP6_Cartridge/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat <<YUM > /etc/yum.repos.d/jbosseap.repo
 [jbosseap]
 name=jbosseap
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbeap/6/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
 
   cat <<YUM > /etc/yum.repos.d/jbossews.repo
 [jbossews]
 name=jbossews
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbews/2/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
   fi
 else
   if [ -n "${DIB_CONF_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/openshift.repo
 [openshift_jbosseap]
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-JBOSSEAP-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-NODE-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 YUM
     fi
 
   if [ -n "${DIB_CONF_JBOSS_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/jbosseap62.repo
 [jbosseap62]
 name=jbosseap62
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}
 enabled=1
 priority=30
-gpgcheck=0
+gpgcheck=1
 YUM
   fi
 fi
 
 # DIB_REG_TYPE of rhn or rhsm should be used if oo-admin-yum-validator is to be triggered
diff --git a/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml b/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
index 05fd34f..3fe969d 100644
--- a/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
+++ b/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
@@ -143,11 +143,11 @@ parameters:
   rh_reg_act_key:
     description: Optional RHN activation key for OpenShift subscription
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:
     description: RHEL Repository Base URL
     type: string
diff --git a/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml b/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
index 5e9118c..5277fb2 100644
--- a/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
+++ b/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
@@ -107,11 +107,11 @@ parameters:
   rh_reg_act_key:
     description: Optional RHN activation key for OpenShift subscription
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:
     description: RHEL Repository Base URL
     type: string
diff --git a/openshift-origin/centos65/OpenShift-1B1N.yaml b/openshift-origin/centos65/OpenShift-1B1N.yaml
index 9528334..6f1e210 100644
--- a/openshift-origin/centos65/OpenShift-1B1N.yaml
+++ b/openshift-origin/centos65/OpenShift-1B1N.yaml
@@ -62,12 +62,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME broker.$dns_prefix$
 
@@ -117,12 +117,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME node.$dns_prefix$
 
diff --git a/openshift-origin/centos65/OpenShift.yaml b/openshift-origin/centos65/OpenShift.yaml
index 69672c7..b516cce 100644
--- a/openshift-origin/centos65/OpenShift.yaml
+++ b/openshift-origin/centos65/OpenShift.yaml
@@ -37,12 +37,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME broker.$dns_prefix$
 

Vulnerable code: gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
gpgcheck=0
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
Fixed code: gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm