CVE-2014-0022: The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the re...

Security readout for executives and security teams

CVE-2014-0022 is a yum-cron flaw where automated updates may fail to enforce RPM package signing checks. If an attacker can influence the update source, an unsigned package could be accepted despite signing restrictions. The sources do not provide a CVSS score, affected OS list, or evidence of active exploitation. Exposure is most likely on legacy Linux systems using yum 3.4.3 or earlier with yum-cron configured to automatically install updates. Risk depends on repository trust, mirror integrity, and whether unsigned package installation could be reached in the local configuration. Prioritize legacy Linux estate review rather than emergency response. Escalate urgency for systems that still run yum-cron automatic installs from externally reachable or weakly controlled repositories. Mitigation focus: Check vendor advisories for fixed yum or yum-cron packages for your distribution.; Update yum and yum-cron through trusted vendor channels where fixes are available.; Disable automatic yum-cron installation on exposed legacy hosts until vendor guidance is applied..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.