CVE-2013-1910 — yum: Not removing bad metadata and using it in next run

Back Back to CVE browser

CRITICAL

yum: Not removing bad metadata and using it in next run

Published Oct 31, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 2.50%

Description

yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.

Affected products

Vendor Yum Product Yum Default
n/a
- Version
  3.4.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yum

n/a

Version	Status	Constraints
3.4.3	affected	-

Red Hat Enterprise Linux 5

yum

Not affected
Red Hat Enterprise Linux 6

yum

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	yum	Not affected	n/a
Red Hat Enterprise Linux 6	yum	Not affected	n/a

Remediation

Red Hat statement

Not vulnerable. This issue did not affect the versions of yum as shipped with Red Hat Enterprise Linux 5 and 6, as yum in those products did not (try to) use filelists metadata yet.

Metrics

2.50% 0.02496

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02496

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.50% (0.02496)	84.11th	v5 (v2026.06.15)
Jun 15, 2026	2.50% (0.02496)	82.56th	v5 (v2026.06.15)
Mar 30, 2025	0.85% (0.00849)	72.76th	v4 (v2025.03.14)
Mar 29, 2025	2.41% (0.02414)	75.12th	v4 (v2025.03.14)
Mar 17, 2025	0.72% (0.00723)	70.85th	v4 (v2025.03.14)
Dec 17, 2024	1.38% (0.01376)	85.99th	v3 (v2023.03.01)
Dec 12, 2024	4.25% (0.04251)	92.58th	v3 (v2023.03.01)
Mar 28, 2024	5.16% (0.05159)	92.81th	v3 (v2023.03.01)
Mar 7, 2023	5.40% (0.05404)	91.92th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Sep 17, 2022	1.11% (0.01108)	53.57th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-347

References (10)

http://www.openwall.com/lists/oss-security/2013/03/29/4
x_refsource_MISCMailing ListThird Party Advisory
http://www.securityfocus.com/bid/58533
x_refsource_MISCThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2013-1910
Vendor Advisory
https://access.redhat.com/security/cve/cve-2013-1910
x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=910446
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1910
x_refsource_MISCIssue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83348
x_refsource_MISCThird Party AdvisoryVDB Entry
https://nvd.nist.gov/vuln/detail/CVE-2013-1910
https://security-tracker.debian.org/tracker/CVE-2013-1910
x_refsource_MISCThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2013-1910

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2013/03/29/4		x_refsource_MISCMailing ListThird Party Advisory
http://www.securityfocus.com/bid/58533		x_refsource_MISCThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2013-1910		Vendor Advisory
https://access.redhat.com/security/cve/cve-2013-1910		x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=910446		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1910		x_refsource_MISCIssue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83348		x_refsource_MISCThird Party AdvisoryVDB Entry
https://nvd.nist.gov/vuln/detail/CVE-2013-1910
https://security-tracker.debian.org/tracker/CVE-2013-1910		x_refsource_MISCThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2013-1910