CVE-2014-0040 (published 2014-06-02T15:55Z)

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openstack/heat-templates
commit_details: repo_url: https://github.com/openstack/heat-templates
author: aweiteka
author_date: 2014-04-04 11:07:56-04:00
msg: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7
repository: repo_url: https://github.com/openstack/heat-templates
repo_name: openstack/heat-templates
description: OpenStack Orchestration (Heat) Templates. Mirror of code maintained at opendev.org.
repo_language: PowerShell
owner: openstack
file_changes: filename: 30-openshift-enterprise-broker
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,8 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/Client/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -23,9 +22,8 @@ YUM
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/Infrastructure/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
   fi
@@ -36,17 +34,15 @@ else
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-CLIENT-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-INFRA-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 YUM
   fi

programming_language: Shell
filename: 30-openshift-enterprise-node
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,8 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/Node/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -23,9 +22,8 @@ YUM
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/JBoss_EAP6_Cartridge/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -35,7 +33,7 @@ name=jbosseap
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbeap/6/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
 
@@ -45,7 +43,7 @@ name=jbossews
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbews/2/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
   fi
@@ -56,17 +54,15 @@ else
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-JBOSSEAP-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-NODE-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 YUM
     fi
 
@@ -77,7 +73,7 @@ name=jbosseap62
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}
 enabled=1
 priority=30
-gpgcheck=0
+gpgcheck=1
 YUM
   fi
 fi

programming_language: Shell
filename: ose_ha_stack.yaml
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@ parameters:
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:

programming_language: Markdown
filename: ose_node_stack.yaml
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,7 @@ parameters:
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:

programming_language: CoffeeScript
filename: OpenShift-1B1N.yaml
change_type: ModificationType.MODIFY
diff: @@ -64,8 +64,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
@@ -119,8 +119,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'

programming_language: Ruby
filename: OpenShift.yaml
change_type: ModificationType.MODIFY
diff: @@ -39,8 +39,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'

programming_language: Ruby