It was discovered that yum-updatesd did not properly perform RPM package signature checks. When yum-updatesd was configured to automatically install updates, a remote attacker could use this flaw to install a malicious update on the target system using an unsigned RPM or an RPM signed with an untrusted key.
Find out more about CVE-2014-0022 from the
MITRE CVE dictionary dictionary and
This issue did not affect the versions of yum as shipped with Red Hat Enterprise Linux 6 and 7.