Description
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | openstack-heat-templates | 0-0.3.20140407git.el6ost | RHSA-2014:0579 |
Advisories 1
- RHSA-2014:0579 Red Hat Security Advisory: openstack-heat-templates security update Red Hat Security Advisories (RHSA) · Jun 28, 2026