A vulnerability was found in yum 3.4.3. It has been rated as critical. Affected by this issue is an unknown part of the file yumRepo.py of the component Metadata Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.

The bug was discovered 03/29/2013. The weakness was presented 10/31/2019. This vulnerability is handled as CVE-2013-1910 since 02/19/2013. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 2407 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at SecurityFocus (BID 58533†) and OSVDB (91835†). See VDB-203262, VDB-207055, VDB-211776 and VDB-223386 for similar entries.

Productinfo

Name

• yum

Version

• 3.4.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion