Every CVESearch/Get API key

SUSE-SU-2026:4129-1

Security update for libzypp, zypper

No scoreFix available

SUSE-SU-2026:4129-1 is a vulnerability with no CVSS score yet in libzypp, published September 11, 2026. No source lists public exploit code. Fixed in libzypp 17.38.15-150500.6.77.1.

What does this mean?
Severity
UnratedNo CVSS score yet
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
17.38.15-150500.6.77.1libzypp +10 more

Description

This update for libzypp, zypper fixes the following issues:

Security issue fixed:

  • invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
  • hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
  • GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).

Non security issues fixed:

  • Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
  • libzypp: X-ZYpp-AnonymousId header anomaly (bsc#1268321).
  • Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
  • zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
  • Zypper patch doesn't give enough details about conflicts (bsc#1277790).
  • dependency issue for package 'python3-vsts-cd-manager' after starting the upgrade (bsc#1261038).

Changes for libzypp:

  • Update to version 17.38.15:

    • Prevent libgpgme from launching gpg-agents; we don't need them.
    • defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
    • Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749)
    • zypp: Improve Testcase Loading for MCP Tools.
    • spec: Remove useless %bcond visibility_hidden (is always ON in cmake)
    • zypp.conf: add solver.NoUpdateProvide (default: false) option.

Changes for zypper:

  • Update to version 1.14.101.

Affected packages

Affected packages
PackageAffectedFixed
libzypp
SUSE:Linux Enterprise Installer Updates 15 SP5
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
libzypp
SUSE:Linux Enterprise Micro 5.5
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
zypper
SUSE:Linux Enterprise Micro 5.5
before 1.14.101-150500.6.48.1
1.14.101-150500.6.48.1
libzypp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
zypper
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
before 1.14.101-150500.6.48.1
1.14.101-150500.6.48.1
libzypp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
zypper
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
before 1.14.101-150500.6.48.1
1.14.101-150500.6.48.1
libzypp
SUSE:Linux Enterprise Server 15 SP5-LTSS
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
zypper
SUSE:Linux Enterprise Server 15 SP5-LTSS
before 1.14.101-150500.6.48.1
1.14.101-150500.6.48.1
libzypp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
before 17.38.15-150500.6.77.1
17.38.15-150500.6.77.1
zypper
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
before 1.14.101-150500.6.48.1
1.14.101-150500.6.48.1

What each source reports

OSVNo score

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues:

Security issue fixed:

  • invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
  • hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
  • GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).

Non security issues fixed:

  • Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
  • libzypp: X-ZYpp-AnonymousId header anomaly (bsc#1268321).
  • Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
  • zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
  • Zypper patch doesn't give enough details about conflicts (bsc#1277790).
  • dependency issue for package 'python3-vsts-cd-manager' after starting the upgrade (bsc#1261038).

Changes for libzypp:

  • Update to version 17.38.15:

    • Prevent libgpgme from launching gpg-agents; we don't need them.
    • defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
    • Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749)
    • zypp: Improve Testcase Loading for MCP Tools.
    • spec: Remove useless %bcond visibility_hidden (is always ON in cmake)
    • zypp.conf: add solver.NoUpdateProvide (default: false) option.

Changes for zypper:

  • Update to version 1.14.101.
Record
SUSE-SU-2026:4129-1
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open