CVE-2014-0042 (published 2014-06-02T15:55Z)

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-310
cwe_name: Cryptographic Issues
description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Fix information:
repo_url: https://github.com/openstack/heat-templates
commit_details: repo_url: https://github.com/openstack/heat-templates
author: aweiteka
author_date: 2014-04-04 11:07:56-04:00
msg: Secure private repo files added to environment

The yum repo files had insecure settings for sslverify and
gpgcheck. Also change references to http to https.

Change-Id: I10cbc33a734f9ed36ef6f22174c65efaf3b659d7
repository: repo_url: https://github.com/openstack/heat-templates
repo_name: openstack/heat-templates
description: OpenStack Orchestration (Heat) Templates. Mirror of code maintained at opendev.org.
repo_language: PowerShell
owner: openstack
file_changes: filename: 30-openshift-enterprise-broker
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,8 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/Client/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -23,9 +22,8 @@ YUM
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/Infrastructure/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
   fi
@@ -36,17 +34,15 @@ else
 name=OpenShift Client
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-CLIENT-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_infrastructure]
 name=OpenShift Infrastructure
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-INFRA-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 YUM
   fi

programming_language: Shell
filename: 30-openshift-enterprise-node
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,8 @@ if [ "${OSE_VERSION}" == "1.2" ]; then
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/Node/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -23,9 +22,8 @@ YUM
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/JBoss_EAP6_Cartridge/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=1
-sslverify=false
 
 YUM
 
@@ -35,7 +33,7 @@ name=jbosseap
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbeap/6/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
 
@@ -45,7 +43,7 @@ name=jbossews
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}/jbews/2/os
 enabled=1
 priority=3
-gpgcheck=0
+gpgcheck=1
 
 YUM
   fi
@@ -56,17 +54,15 @@ else
 name=OpenShift JBossEAP
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-JBOSSEAP-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 
 [openshift_node]
 name=OpenShift Node
 baseurl=${DIB_CONF_REPO_BASE}/RHOSE-NODE-2.0/x86_64/os/
 enabled=1
-gpgcheck=0
+gpgcheck=1
 priority=10
-sslverify=false
 YUM
     fi
 
@@ -77,7 +73,7 @@ name=jbosseap62
 baseurl=${DIB_CONF_JBOSS_REPO_BASE}
 enabled=1
 priority=30
-gpgcheck=0
+gpgcheck=1
 YUM
   fi
 fi

programming_language: Shell
filename: ose_ha_stack.yaml
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@ parameters:
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:

programming_language: Markdown
filename: ose_node_stack.yaml
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,7 @@ parameters:
     type: string
     default: ""
   rh_reg_opts:
-    description: RHN options, e.g. --serverUrl=http://my.sat.server.com/XMLRPC
+    description: RHN options, e.g. --serverUrl=https://my.sat.server.com/XMLRPC
     type: string
     default: ""
   rhel_repo_base:

programming_language: CoffeeScript
filename: OpenShift-1B1N.yaml
change_type: ModificationType.MODIFY
diff: @@ -64,8 +64,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'
@@ -119,8 +119,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'

programming_language: Ruby
filename: OpenShift.yaml
change_type: ModificationType.MODIFY
diff: @@ -39,8 +39,8 @@ resources:
           template: |
             #!/bin/bash -v
 
-            yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
-            yum -y install http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
+            yum -y install https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
+            yum -y install https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-10.noarch.rpm
             yum -y install augeas
 
             augtool setm /files/etc/yum.repos.d/puppetlabs.repo/* exclude '*mcollective*\ activemq'

programming_language: Ruby