SUSE-SU-2026:23547-1
Security update for libzypp, zypper
No scoreFix available
SUSE-SU-2026:23547-1 is a vulnerability with no CVSS score yet in libzypp, published September 9, 2026. No source lists public exploit code. Fixed in libzypp 17.38.15-1.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
17.38.15-1.1libzypp +1 more
Description
This update for libzypp, zypper fixes the following issues:
Security issue fixed:
- invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
- hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
- GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).
Non security issues fixed:
- Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
- Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
- zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
- Zypper patch doesn't give enough details about conflicts (bsc#1277790).
Changes for libzypp:
Update to version 17.38.15:
- Prevent libgpgme from launching gpg-agents; we don't need them.
- defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
- Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749)
- zypp: Improve Testcase Loading for MCP Tools.
- spec: Remove useless %bcond visibility_hidden (is always ON in cmake)
Changes for zypper:
- Update to version 1.14.101.
Affected packages
What each source reports
OSVNo score
Security update for libzypp, zypper
This update for libzypp, zypper fixes the following issues:
Security issue fixed:
- invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
- hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
- GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).
Non security issues fixed:
- Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
- Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
- zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
- Zypper patch doesn't give enough details about conflicts (bsc#1277790).
Changes for libzypp:
Update to version 17.38.15:
- Prevent libgpgme from launching gpg-agents; we don't need them.
- defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
- Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749)
- zypp: Improve Testcase Loading for MCP Tools.
- spec: Remove useless %bcond visibility_hidden (is always ON in cmake)
Changes for zypper:
- Update to version 1.14.101.
- Record
SUSE-SU-2026:23547-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.