CVE-2018-7685

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.

This update for libzypp, zypper provides the following fixes:

libzypp security fixes:

• CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)
• CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)
• CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes:

• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• Prefer calling 'repo2solv' rather than 'repo2solv.sh'.
• libzypp-devel should not require cmake. (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)
• Avoid zombie tar processes. (bsc#1076192)
• man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)
• ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)
• RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
• PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
• Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
• Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes:

• download: fix crash when non-package types are passed as argument (bsc#1037210)
• XML <install-summary> attribute packages-to-change added (bsc#1102429)

This update for libzypp, zypper fixes the following issues:

libzypp security fixes:

• PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)
• Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)

libzypp other changes/bugs fixed:

• Update to version 14.45.17
• RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
• PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
• Adapt to work with GnuPG 2.1.23 (bsc#1054088)
• repo refresh: Re-probe if the repository type changes (bsc#1048315)
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• Prefer calling 'repo2solv' rather than 'repo2solv.sh'
• libzypp-devel should not require cmake (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• Avoid zombie tar processes (bsc#1076192)
• lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

zypper security fixes:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
• Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper other changes/bugs fixed:

• Update to version 1.11.70
• Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• do not recommend cron (bsc#1079334)

This update for libzypp, zypper, libsolv provides the following fixes:

Security fixes in libzypp:

• CVE-2018-7685: PackageProvider: Validate RPMs before caching (bsc#1091624, bsc#1088705)
• CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)

Changes in libzypp:

• Update to version 17.6.4
• Automatically fetch repository signing key from gpgkey url (bsc#1088037)
• lsof: use '-K i' if lsof supports it (bsc#1099847,bsc#1036304)
• Check for not imported keys after multi key import from rpmdb (bsc#1096217)
• Flags: make it std=c++14 ready
• Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)
• Show GPGME version in log
• Adapt to changes in libgpgme11-11.1.0 breaking the signature verification (bsc#1100427)
• RepoInfo::provideKey: add report telling where we look for missing keys.
• Support listing gpgkey URLs in repo files (bsc#1088037)
• Add new report to request user approval for importing a package key
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• Add filesize check for downloads with known size (bsc#408814)
• Removed superfluous space in translation (bsc#1102019)
• Prevent the system from sleeping during a commit
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• libzypp-devel should not require cmake (bsc#1101349)
• Avoid zombies from ExternalProgram
• Update ApiConfig
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• lsof: use '-K i' if lsof supports it (bsc#1099847)
• Add filesize check for downloads with known size (bsc#408814)
• Fix detection of metalink downloads and prevent aborting if a metalink file is larger than the expected data file.
• Require libsolv-devel >= 0.6.35 during build (fixing bsc#1100095)
• Make use of %license macro (bsc#1082318)

Security fix in zypper:

• CVE-2017-9269: Improve signature check callback messages (bsc#1045735)

Changes in zypper:

• Always set error status if any nr of unknown repositories are passed to lr and ref (bsc#1093103)
• Notify user about unsupported rpm V3 keys in an old rpm database (bsc#1096217)
• Detect read only filesystem on system modifying operations (fixes #199)
• Use %license (bsc#1082318)
• Handle repo aliases containing multiple ':' in the PackageArgs parser (bsc #1041178)
• Fix broken display of detailed query results.
• Fix broken search for items with a dash. (bsc#907538, bsc#1043166, bsc#1070770)
• Disable repository operations when searching installed packages. (bsc#1084525)
• Prevent nested calls to exit() if aborted by a signal. (bsc#1092413)
• ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)
• Fix some translation errors.
• Support listing gpgkey URLs in repo files (bsc#1088037)
• Check for root privileges in zypper verify and si (bsc#1058515)
• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• Add expert (allow-*) options to all installer commands (bsc#428822)
• Sort search results by multiple columns (bsc#1066215)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• Set error status if repositories passed to lr and ref are not known (bsc#1093103)
• Do not override table style in search
• Fix out of bound read in MbsIterator
• Add --supplements switch to search and info
• Add setter functions for zypp cache related config values to ZConfig

Changes in libsolv:

• convert repo2solv.sh script into a binary tool
• Make use of %license macro (bsc#1082318)

This update for libzypp, zypper provides the following fixes:

Update libzypp to version 16.17.20

Security issues fixed:

• PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed:

• lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• libzypp-devel should not require cmake (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45

Security issue fixed:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Other bugs fixed:

• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• Prevent nested calls to exit() if aborted by a signal (bsc#1092413)
• ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• Fix: zypper bash completion expands non-existing options (bsc#1049825)
• do not recommend cron (bsc#1079334)
• Improve signature check callback messages (bsc#1045735)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735)

This update for libzypp, zypper provides the following fixes:

Update libzypp to version 16.17.20

Security issues fixed:

• PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed:

• lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• libzypp-devel should not require cmake (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45

Security issue fixed:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Other bugs fixed:

• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• Prevent nested calls to exit() if aborted by a signal (bsc#1092413)
• ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• Fix: zypper bash completion expands non-existing options (bsc#1049825)
• do not recommend cron (bsc#1079334)
• Improve signature check callback messages (bsc#1045735)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735)

This update for libzypp, zypper fixes the following issues:

Update libzypp to version 16.17.20:

Security issues fixed:

• PackageProvider: Validate deta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)
• PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed:

• lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)
• Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
• RepoManager: Explicitly request repo2solv to generate application pseudo packages.
• libzypp-devel should not require cmake (bsc#1101349)
• HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)
• Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45:

Security issues fixed:

• Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Other bugs fixed:

• XML <install-summary> attribute packages-to-change added (bsc#1102429)
• man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)
• Prevent nested calls to exit() if aborted by a signal (bsc#1092413)
• ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)
• Fix: zypper bash completion expands non-existing options (bsc#1049825)
• Improve signature check callback messages (bsc#1045735)
• add/modify repo: Add options to tune the GPG check settings (bsc#1045735)