Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: SUSE libzypp — SUSE-SU-2017:2040 Clear all filters
TI-2017-06710 CVE-2017-9269 · GHSA-fvp9-wx3h-666q

lack of keypinning in libzypp could lead to repository switching

Priority MEDIUM 46

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02247 Published 2018-03-01 Fixed in 201808 CWE-757
TI-2017-05088 CVE-2017-7436 · GHSA-wf75-8v2m-5h2m

libzypp accepts unsigned packages even when configured to check signatures

Priority LOW 39

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01824 Published 2018-03-01 Fixed in 20170803 CWE-20
TI-2017-05087 CVE-2017-7435 · GHSA-gvfg-vcp7-gmf9

libzypp accepts unsigned 3rd party repo without warning

Priority LOW 39

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01809 Published 2018-03-01 Fixed in 20170803 CWE-20