{"id":"CVE-2017-7435","aliases":["DEBIAN-CVE-2017-7435","EUVD-2017-16459","GHSA-gvfg-vcp7-gmf9","SUSE-SU-2017:2040-1","SUSE-SU-2017:2264-1","SUSE-SU-2018:2555-1","SUSE-SU-2018:2688-1","UBUNTU-CVE-2017-7435","openSUSE-SU-2024:11019-1"],"status":"published","title":"libzypp accepts unsigned 3rd party repo without warning","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01809,"percentile":0.78744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-08-03T14:42:36Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Debian:12","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"yast2-pkg-bindings-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.45.17-2.82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.70-2.69.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.3.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.28.4-1.2"}]}],"bundled":5}],"products":[{"vendor":"opensuse","product":"libzypp"},{"vendor":"suse","product":"libzypp"}],"references":[{"url":"https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.suse.com/de-de/security/cve/CVE-2017-7435/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1009127","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7435"},{"url":"https://github.com/advisories/GHSA-gvfg-vcp7-gmf9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7435","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009745","tags":["report"]},{"url":"https://bugzilla.suse.com/1031756","tags":["report"]},{"url":"https://bugzilla.suse.com/1033236","tags":["report"]},{"url":"https://bugzilla.suse.com/1038132","tags":["report"]},{"url":"https://bugzilla.suse.com/1038984","tags":["report"]},{"url":"https://bugzilla.suse.com/1043218","tags":["report"]},{"url":"https://bugzilla.suse.com/1045735","tags":["report"]},{"url":"https://bugzilla.suse.com/1047785","tags":["report"]},{"url":"https://bugzilla.suse.com/1048315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9269","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172264-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036659","tags":["report"]},{"url":"https://bugzilla.suse.com/1046417","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1037210","tags":["report"]},{"url":"https://bugzilla.suse.com/1054088","tags":["report"]},{"url":"https://bugzilla.suse.com/1070851","tags":["report"]},{"url":"https://bugzilla.suse.com/1076192","tags":["report"]},{"url":"https://bugzilla.suse.com/1088705","tags":["report"]},{"url":"https://bugzilla.suse.com/1091624","tags":["report"]},{"url":"https://bugzilla.suse.com/1092413","tags":["report"]},{"url":"https://bugzilla.suse.com/1096803","tags":["report"]},{"url":"https://bugzilla.suse.com/1100028","tags":["report"]},{"url":"https://bugzilla.suse.com/1101349","tags":["report"]},{"url":"https://bugzilla.suse.com/1102429","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7685","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036304","tags":["report"]},{"url":"https://bugzilla.suse.com/1079334","tags":["report"]},{"url":"https://bugzilla.suse.com/1099847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7435","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7435","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18900","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7435","title":"libzypp accepts unsigned 3rd party repo without warning","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-16T22:14:57.477Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16459","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-16T22:14:57Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:04.822795Z"}],"ghsa":[{"id":"GHSA-gvfg-vcp7-gmf9","title":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to...","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2022-05-13T01:36:21Z","modified":"2023-02-01T05:08:56Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2017-7435","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.617Z","modified":"2026-06-17T01:24:20.923Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-7435","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.617Z","modified":"2026-10-24T10:30:29.32493585Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7435","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.617Z","modified":"2026-09-01T20:03:50.043500659Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7435","description":"In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00Z","modified":"2026-04-22T11:30:56.845914Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"openSUSE-SU-2024:11019-1","title":"libzypp-17.28.4-1.2 on GA media","description":"These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:01.49937Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2040-1","title":"Security update for libzypp, zypper","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\nlibzypp:\n\nSecurity issues fixed:\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n\nBug fixes:\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n- Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)\n- Fix potential crash if repository has no baseurl. (bsc#1043218)\n\nzypper:\n\n- Adapt download callback to report and handle unsigned packages. (bsc#1038984)\n- Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)\n- Document support for custom repository variables defined in /etc/zypp/vars.d.\n- Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent\n  if PK blocks package management.\n","status":"published","published":"2017-08-03T14:42:36Z","modified":"2025-05-02T04:07:01.097392Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2264-1","title":"Security update for libzypp","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\n\nlibzypp:\n\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)\n- Update lsof blacklist. (bsc#1046417)\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n\nyast2-pkg-bindings:\n\n- Do not crash when the repository URL is not defined. (bsc#1043218)\n","status":"published","published":"2017-08-25T13:14:39Z","modified":"2026-02-04T02:47:36.533125Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:2555-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper provides the following fixes:\n\nlibzypp security fixes:\n\n- CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)\n- CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows,\n  mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)\n\nlibzypp changes:\n\n- RepoManager: Explicitly request repo2solv to generate application pseudo packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'.\n- libzypp-devel should not require cmake. (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)\n- Avoid zombie tar processes. (bsc#1076192)\n- man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n  Use 'gpg --list-packets' to determine the keyid to verify a signature.\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)\n\nzypper changes:\n\n- download: fix crash when non-package types are passed as argument (bsc#1037210)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n","status":"published","published":"2018-08-30T06:44:57Z","modified":"2026-02-04T03:22:05.877871Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2688-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper fixes the following issues:\n\nlibzypp security fixes:\n\n- PackageProvider: Validate delta rpms before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)\n- Fix repo gpg check workflows, mainly for unsigned repos and packages\n  (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)\n\nlibzypp other changes/bugs fixed:\n\n- Update to version 14.45.17\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application pseudo\n  packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been been\n  loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735,\n  CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984,\n  CVE-2017-7436)\n\nzypper other changes/bugs fixed:\n\n- Update to version 1.11.70\n- Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- do not recommend cron (bsc#1079334)\n","status":"published","published":"2018-09-11T12:59:55Z","modified":"2026-02-04T03:16:13.216366Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}