CVE-2017-7435

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

Security issues fixed:

• CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)

Bug fixes:

• Re-probe on refresh if the repository type changes. (bsc#1048315)
• Propagate proper error code to DownloadProgressReport. (bsc#1047785)
• Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
• Support custom repo variables defined in /etc/zypp/vars.d.
• Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)
• Fix potential crash if repository has no baseurl. (bsc#1043218)

zypper:

• Adapt download callback to report and handle unsigned packages. (bsc#1038984)
• Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)
• Document support for custom repository variables defined in /etc/zypp/vars.d.
• Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent if PK blocks package management.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

• CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)
• Fix gpg-pubkey release (creation time) computation. (bsc#1036659)
• Update lsof blacklist. (bsc#1046417)
• Re-probe on refresh if the repository type changes. (bsc#1048315)
• Propagate proper error code to DownloadProgressReport. (bsc#1047785)
• Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
• Support custom repo variables defined in /etc/zypp/vars.d.

yast2-pkg-bindings:

• Do not crash when the repository URL is not defined. (bsc#1043218)

This update for libzypp, zypper provides the following fixes:

libzypp security fixes:

• CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)
• CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)
• CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes:

• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• Prefer calling 'repo2solv' rather than 'repo2solv.sh'.
• libzypp-devel should not require cmake. (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)
• Avoid zombie tar processes. (bsc#1076192)
• man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)
• ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)
• RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
• PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
• Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
• Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes:

• download: fix crash when non-package types are passed as argument (bsc#1037210)
• XML <install-summary> attribute packages-to-change added (bsc#1102429)

This update for libzypp, zypper fixes the following issues:

libzypp security fixes:

• PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)
• Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)

libzypp other changes/bugs fixed:

• Update to version 14.45.17
• RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
• PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
• Adapt to work with GnuPG 2.1.23 (bsc#1054088)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• Prefer calling 'repo2solv' rather than 'repo2solv.sh'
• libzypp-devel should not require cmake (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• Avoid zombie tar processes (bsc#1076192)
• lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

zypper security fixes:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
• Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper other changes/bugs fixed:

• Update to version 1.11.70
• Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• do not recommend cron (bsc#1079334)