{"id":"CVE-2017-7436","aliases":["DEBIAN-CVE-2017-7436","EUVD-2017-16460","GHSA-wf75-8v2m-5h2m","SUSE-SU-2017:2040-1","SUSE-SU-2017:2264-1","SUSE-SU-2017:2344-1","SUSE-SU-2018:2555-1","SUSE-SU-2018:2688-1","UBUNTU-CVE-2017-7436","openSUSE-SU-2024:11545-1"],"status":"published","title":"libzypp accepts unsigned packages even when configured to check signatures","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01824,"percentile":0.78937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-08-03T14:42:36Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Debian:12","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","fixed_in":["16.15.6-2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zypper","fixed_in":["1.13.32-21.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","fixed_in":["16.15.6-2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","fixed_in":["16.15.6-2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"zypper","fixed_in":["1.13.32-21.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","fixed_in":["16.15.6-2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"zypper","fixed_in":["1.13.32-21.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"yast2-pkg-bindings-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.6-2.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.32-21.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.6-2.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.6-2.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.32-21.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.6-2.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.32-21.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.45.17-2.82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.70-2.69.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.3.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.49-1.2"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"libzypp"},{"vendor":"suse","product":"libzypp"}],"references":[{"url":"https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1038984","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://www.suse.com/de-de/security/cve/CVE-2017-7436/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7436"},{"url":"https://github.com/advisories/GHSA-wf75-8v2m-5h2m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7436","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009745","tags":["report"]},{"url":"https://bugzilla.suse.com/1031756","tags":["report"]},{"url":"https://bugzilla.suse.com/1033236","tags":["report"]},{"url":"https://bugzilla.suse.com/1038132","tags":["report"]},{"url":"https://bugzilla.suse.com/1038984","tags":["report"]},{"url":"https://bugzilla.suse.com/1043218","tags":["report"]},{"url":"https://bugzilla.suse.com/1045735","tags":["report"]},{"url":"https://bugzilla.suse.com/1047785","tags":["report"]},{"url":"https://bugzilla.suse.com/1048315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9269","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172264-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036659","tags":["report"]},{"url":"https://bugzilla.suse.com/1046417","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172344-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008325","tags":["report"]},{"url":"https://bugzilla.suse.com/1054088","tags":["report"]},{"url":"https://bugzilla.suse.com/1054671","tags":["report"]},{"url":"https://bugzilla.suse.com/1055920","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1037210","tags":["report"]},{"url":"https://bugzilla.suse.com/1070851","tags":["report"]},{"url":"https://bugzilla.suse.com/1076192","tags":["report"]},{"url":"https://bugzilla.suse.com/1088705","tags":["report"]},{"url":"https://bugzilla.suse.com/1091624","tags":["report"]},{"url":"https://bugzilla.suse.com/1092413","tags":["report"]},{"url":"https://bugzilla.suse.com/1096803","tags":["report"]},{"url":"https://bugzilla.suse.com/1100028","tags":["report"]},{"url":"https://bugzilla.suse.com/1101349","tags":["report"]},{"url":"https://bugzilla.suse.com/1102429","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7685","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036304","tags":["report"]},{"url":"https://bugzilla.suse.com/1079334","tags":["report"]},{"url":"https://bugzilla.suse.com/1099847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7436","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-7436","title":"libzypp accepts unsigned packages even when configured to check signatures","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-16T19:09:24.691Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16460","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-16T19:09:24Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:25.778976Z"}],"ghsa":[{"id":"GHSA-wf75-8v2m-5h2m","title":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the...","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2022-05-13T01:36:21Z","modified":"2023-02-01T05:08:41Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:49.963472Z"}],"nvd":[{"id":"CVE-2017-7436","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.693Z","modified":"2026-06-17T01:24:21.05Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-7436","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.693Z","modified":"2026-10-24T10:30:36.224199746Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7436","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00.693Z","modified":"2026-09-01T20:02:42.652182487Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7436","description":"In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.","status":"published","published":"2018-03-01T20:29:00Z","modified":"2026-04-22T11:31:41.762965Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"openSUSE-SU-2024:11545-1","title":"zypper-1.14.49-1.2 on GA media","description":"These are all security issues fixed in the zypper-1.14.49-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:35.352292Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:2040-1","title":"Security update for libzypp, zypper","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\nlibzypp:\n\nSecurity issues fixed:\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n\nBug fixes:\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n- Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)\n- Fix potential crash if repository has no baseurl. (bsc#1043218)\n\nzypper:\n\n- Adapt download callback to report and handle unsigned packages. (bsc#1038984)\n- Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)\n- Document support for custom repository variables defined in /etc/zypp/vars.d.\n- Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent\n  if PK blocks package management.\n","status":"published","published":"2017-08-03T14:42:36Z","modified":"2025-05-02T04:07:01.097392Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2264-1","title":"Security update for libzypp","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\n\nlibzypp:\n\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)\n- Update lsof blacklist. (bsc#1046417)\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n\nyast2-pkg-bindings:\n\n- Do not crash when the repository URL is not defined. (bsc#1043218)\n","status":"published","published":"2017-08-25T13:14:39Z","modified":"2026-02-04T02:47:36.533125Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2344-1","title":"Security update for libzypp, zypper","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\nlibzypp:\n\n- Adapt to work with GnuPG 2.1.23. (bsc#1054088)\n- Support signing with subkeys. (bsc#1008325)\n- Enhance sort order for media.1/products. (bsc#1054671)\n\nzypper:\n\n- Also show a gpg key's subkeys. (bsc#1008325)\n- Improve signature check callback messages. (bsc#1045735)\n- Add options to tune the GPG check settings. (bsc#1045735)\n- Adapt download callback to report and handle unsigned packages. (bsc#1038984, CVE-2017-7436)\n- Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)\n","status":"published","published":"2017-09-04T13:38:32Z","modified":"2026-02-04T03:04:26.047875Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:2555-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper provides the following fixes:\n\nlibzypp security fixes:\n\n- CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)\n- CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows,\n  mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)\n\nlibzypp changes:\n\n- RepoManager: Explicitly request repo2solv to generate application pseudo packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'.\n- libzypp-devel should not require cmake. (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)\n- Avoid zombie tar processes. (bsc#1076192)\n- man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n  Use 'gpg --list-packets' to determine the keyid to verify a signature.\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)\n\nzypper changes:\n\n- download: fix crash when non-package types are passed as argument (bsc#1037210)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n","status":"published","published":"2018-08-30T06:44:57Z","modified":"2026-02-04T03:22:05.877871Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2688-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper fixes the following issues:\n\nlibzypp security fixes:\n\n- PackageProvider: Validate delta rpms before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)\n- Fix repo gpg check workflows, mainly for unsigned repos and packages\n  (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)\n\nlibzypp other changes/bugs fixed:\n\n- Update to version 14.45.17\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application pseudo\n  packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been been\n  loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735,\n  CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984,\n  CVE-2017-7436)\n\nzypper other changes/bugs fixed:\n\n- Update to version 1.11.70\n- Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- do not recommend cron (bsc#1079334)\n","status":"published","published":"2018-09-11T12:59:55Z","modified":"2026-02-04T03:16:13.216366Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}