CVE-2014-3585

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3585
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://access.redhat.com/security/cve/cve-2014-3585 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3585 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:redhat-upgrade-tool:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:40

Type Values Removed Values Added
Summary It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process. redhat-upgrade-tool: Does not check GPG signatures when upgrading versions
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-3585', 'name': 'https://access.redhat.com/security/cve/CVE-2014-3585', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHBA-2015:2395', 'name': 'https://access.redhat.com/errata/RHBA-2015:2395', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1126002', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1126002', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHBA-2014:1396', 'name': 'https://access.redhat.com/errata/RHBA-2014:1396', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 15:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-3585 -
  • (MISC) https://access.redhat.com/errata/RHBA-2015:2395 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1126002 -
  • (MISC) https://access.redhat.com/errata/RHBA-2014:1396 -
Summary redhat-upgrade-tool: Does not check GPG signatures when upgrading versions It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process.
Information

Published : 2019-11-22 15:15

Updated : 2023-12-10 13:13

NVD link : CVE-2014-3585

Mitre link : CVE-2014-3585

CVE.ORG link : CVE-2014-3585

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • redhat-upgrade-tool
CWE
CWE-347

Improper Verification of Cryptographic Signature