CVE-2014-0042 (YAML, published 2014-06-02T15:55Z)
Description: value: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/openstack/heat-templates
Files changed:
openshift-enterprise/dib/elements/openshift-enterprise-broker/install.d/30-openshift-enterprise-broker
openshift-enterprise/dib/elements/openshift-enterprise-node/install.d/30-openshift-enterprise-node
openshift-enterprise/heat/neutron/highly-available/ose_ha_stack.yaml
openshift-enterprise/heat/neutron/highly-available/ose_node_stack.yaml
openshift-origin/centos65/OpenShift-1B1N.yaml
openshift-origin/centos65/OpenShift.yaml
Commit message: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7


Vulnerable code:
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
gpgcheck=0
gpgcheck=0
sslverify=false
gpgcheck=0
sslverify=false
gpgcheck=0
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm

Fixed code:
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
gpgcheck=1
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm