CVE-2014-0042: Cryptographic Issues (CWE-310)
value: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2014-06-02T15:55Z
Repository: https://github.com/openstack/heat-templates
Language: YAML
Files changed: openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker, openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node, openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml, openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml, openshift-origin/centos65/OpenShift-1B1N.yaml, openshift-origin/centos65/OpenShift.yaml
Commit date: 2014-04-04 13:20:00 -0400
Commit message: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7

Diff: diff --git a/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker b/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
index 82c0c42..7d441c1 100755
--- a/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
+++ b/openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
@@ -10,45 +10,41 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
   cat > /etc/yum.repos.d/openshift-client.repo <<YUM
 [openshift_client]
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/Client/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat > /etc/yum.repos.d/openshift-infrastructure.repo <<YUM
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/Infrastructure/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
   fi
 else
   if [ -n "${DIB_CONF_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/openshift.repo
 [openshift_client]
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-CLIENT-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-INFRA-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 YUM
   fi
 fi
 
diff --git a/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node b/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
index f7981ad..4350747 100755
--- a/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
+++ b/openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
@@ -10,76 +10,72 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
   cat > /etc/yum.repos.d/openshift-node.repo <<YUM
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/Node/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat > /etc/yum.repos.d/openshift-jboss.repo <<YUM
 [openshift_jbosseap]
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/JBoss_EAP6_Cartridge/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
   cat <<YUM > /etc/yum.repos.d/jbosseap.repo
 [jbosseap]
 name=jbosseap
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbeap/6/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
 
   cat <<YUM > /etc/yum.repos.d/jbossews.repo
 [jbossews]
 name=jbossews
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbews/2/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
   fi
 else
   if [ -n "${DIB_CONF_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/openshift.repo
 [openshift_jbosseap]
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-JBOSSEAP-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-NODE-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 YUM
     fi
 
   if [ -n "${DIB_CONF_JBOSS_REPO_BASE}" ]; then
       cat <<YUM > /etc/yum.repos.d/jbosseap62.repo
 [jbosseap62]
 name=jbosseap62
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}
 enabled=1
 priority=30
-gpgcheck=0
+gpgcheck=1
 YUM
   fi
 fi
 
 # DIB_REG_TYPE of rhn or rhsm should be used if oo-admin-yum-validator is to be triggered
diff --git a/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml b/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
index 05fd34f..3fe969d 100644
--- a/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
+++ b/openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
@@ -143,11 +143,11 @@ parameters:
   rh_reg_act_key:
     description: Optional RHN activation key for OpenShift subscription
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:
     description: RHEL Repository Base URL
     type: string
diff --git a/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml b/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
index 5e9118c..5277fb2 100644
--- a/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
+++ b/openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
@@ -107,11 +107,11 @@ parameters:
   rh_reg_act_key:
     description: Optional RHN activation key for OpenShift subscription
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:
     description: RHEL Repository Base URL
     type: string
diff --git a/openshift-origin/centos65/OpenShift-1B1N.yaml b/openshift-origin/centos65/OpenShift-1B1N.yaml
index 9528334..6f1e210 100644
--- a/openshift-origin/centos65/OpenShift-1B1N.yaml
+++ b/openshift-origin/centos65/OpenShift-1B1N.yaml
@@ -62,12 +62,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME broker.$dns_prefix$
 
@@ -117,12 +117,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME node.$dns_prefix$
 
diff --git a/openshift-origin/centos65/OpenShift.yaml b/openshift-origin/centos65/OpenShift.yaml
index 69672c7..b516cce 100644
--- a/openshift-origin/centos65/OpenShift.yaml
+++ b/openshift-origin/centos65/OpenShift.yaml
@@ -37,12 +37,12 @@ resources:
       user_data:
         str_replace:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
             augtool set /files/etc/sysconfig/network/HOSTNAME broker.$dns_prefix$
 

Vulnerable code: gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
gpgcheck=0
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
Fixed code: gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm