CVE-2014-0040 (YAML, published 2014-06-02T15:55Z)
Description: value: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openstack/heat-templates
Files changed:
openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
openshift-origin/centos65/OpenShift-1B1N.yaml
openshift-origin/centos65/OpenShift.yaml
Commit message: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7


Vulnerable code:
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
gpgcheck=0
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm

Fixed code:
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm