{"id":"CVE-2017-9269","aliases":["DEBIAN-CVE-2017-9269","EUVD-2017-18205","GHSA-fvp9-wx3h-666q","SUSE-SU-2017:2040-1","SUSE-SU-2017:2264-1","SUSE-SU-2018:2555-1","SUSE-SU-2018:2688-1","SUSE-SU-2018:2690-1","SUSE-SU-2018:2716-1","SUSE-SU-2018:2716-2","SUSE-SU-2018:2814-1","UBUNTU-CVE-2017-9269","openSUSE-SU-2024:11019-1","openSUSE-SU-2024:11545-1"],"status":"published","title":"lack of keypinning in libzypp could lead to repository switching","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","severity":{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02247,"percentile":0.82999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-757"],"published":"2017-08-03T14:42:36Z","modified":"2026-09-01T20:03:51Z","fixes":[{"ecosystem":"Debian:12","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libzypp","fixed_in":["17.3.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.3.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.2-27.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.30-18.13.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"yast2-pkg-bindings-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15.3-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"yast2-pkg-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.25.17-46.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.59-46.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.45.17-2.82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.70-2.69.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.35-3.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6.4-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.35-3.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-27.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-18.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-27.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-18.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-27.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-18.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-27.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-18.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-27.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-18.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-2.33.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-21.21.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-2.33.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-2.33.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-21.21.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.20-2.33.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.45-21.21.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.3.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.28.4-1.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.49-1.2"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"libzypp"},{"vendor":"suse","product":"libzypp"}],"references":[{"url":"https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1045735","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://www.suse.com/de-de/security/cve/CVE-2017-9269/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9269"},{"url":"https://github.com/advisories/GHSA-fvp9-wx3h-666q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9269","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009745","tags":["report"]},{"url":"https://bugzilla.suse.com/1031756","tags":["report"]},{"url":"https://bugzilla.suse.com/1033236","tags":["report"]},{"url":"https://bugzilla.suse.com/1038132","tags":["report"]},{"url":"https://bugzilla.suse.com/1038984","tags":["report"]},{"url":"https://bugzilla.suse.com/1043218","tags":["report"]},{"url":"https://bugzilla.suse.com/1045735","tags":["report"]},{"url":"https://bugzilla.suse.com/1047785","tags":["report"]},{"url":"https://bugzilla.suse.com/1048315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9269","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172264-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036659","tags":["report"]},{"url":"https://bugzilla.suse.com/1046417","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1037210","tags":["report"]},{"url":"https://bugzilla.suse.com/1054088","tags":["report"]},{"url":"https://bugzilla.suse.com/1070851","tags":["report"]},{"url":"https://bugzilla.suse.com/1076192","tags":["report"]},{"url":"https://bugzilla.suse.com/1088705","tags":["report"]},{"url":"https://bugzilla.suse.com/1091624","tags":["report"]},{"url":"https://bugzilla.suse.com/1092413","tags":["report"]},{"url":"https://bugzilla.suse.com/1096803","tags":["report"]},{"url":"https://bugzilla.suse.com/1100028","tags":["report"]},{"url":"https://bugzilla.suse.com/1101349","tags":["report"]},{"url":"https://bugzilla.suse.com/1102429","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7685","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036304","tags":["report"]},{"url":"https://bugzilla.suse.com/1079334","tags":["report"]},{"url":"https://bugzilla.suse.com/1099847","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1041178","tags":["report"]},{"url":"https://bugzilla.suse.com/1043166","tags":["report"]},{"url":"https://bugzilla.suse.com/1058515","tags":["report"]},{"url":"https://bugzilla.suse.com/1066215","tags":["report"]},{"url":"https://bugzilla.suse.com/1070770","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1084525","tags":["report"]},{"url":"https://bugzilla.suse.com/1088037","tags":["report"]},{"url":"https://bugzilla.suse.com/1093103","tags":["report"]},{"url":"https://bugzilla.suse.com/1096217","tags":["report"]},{"url":"https://bugzilla.suse.com/1096617","tags":["report"]},{"url":"https://bugzilla.suse.com/1100095","tags":["report"]},{"url":"https://bugzilla.suse.com/1100427","tags":["report"]},{"url":"https://bugzilla.suse.com/1102019","tags":["report"]},{"url":"https://bugzilla.suse.com/408814","tags":["report"]},{"url":"https://bugzilla.suse.com/428822","tags":["report"]},{"url":"https://bugzilla.suse.com/907538","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182716-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1049825","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182716-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182814-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9269","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18900","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9269","title":"lack of keypinning in libzypp could lead to repository switching","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-17T00:36:56.264Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-757"],"updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18205","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T19:00:00Z","modified":"2024-09-17T00:36:56Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T00:28:57.378482Z"}],"ghsa":[{"id":"GHSA-fvp9-wx3h-666q","title":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned,...","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2022-05-13T01:36:09Z","modified":"2023-02-01T05:08:34Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2017-9269","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T20:29:00.82Z","modified":"2026-06-17T01:27:47.547Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-757","CWE-20"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-9269","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T20:29:00.82Z","modified":"2026-03-15T22:18:05.03499Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9269","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T20:29:00.82Z","modified":"2026-09-01T20:03:51.636183514Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9269","description":"In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.","status":"published","published":"2018-03-01T20:29:00Z","modified":"2026-04-22T11:37:08.836911Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"openSUSE-SU-2024:11019-1","title":"libzypp-17.28.4-1.2 on GA media","description":"These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:01.49937Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11545-1","title":"zypper-1.14.49-1.2 on GA media","description":"These are all security issues fixed in the zypper-1.14.49-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:35.352292Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:2040-1","title":"Security update for libzypp, zypper","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\nlibzypp:\n\nSecurity issues fixed:\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n\nBug fixes:\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n- Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)\n- Fix potential crash if repository has no baseurl. (bsc#1043218)\n\nzypper:\n\n- Adapt download callback to report and handle unsigned packages. (bsc#1038984)\n- Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)\n- Document support for custom repository variables defined in /etc/zypp/vars.d.\n- Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent\n  if PK blocks package management.\n","status":"published","published":"2017-08-03T14:42:36Z","modified":"2025-05-02T04:07:01.097392Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2264-1","title":"Security update for libzypp","description":"The Software Update Stack was updated to receive fixes and enhancements.\n\n\nlibzypp:\n\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned\n  repositories and packages. (bsc#1045735, bsc#1038984)\n- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)\n- Update lsof blacklist. (bsc#1046417)\n- Re-probe on refresh if the repository type changes. (bsc#1048315)\n- Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n- Support custom repo variables defined in /etc/zypp/vars.d.\n\nyast2-pkg-bindings:\n\n- Do not crash when the repository URL is not defined. (bsc#1043218)\n","status":"published","published":"2017-08-25T13:14:39Z","modified":"2026-02-04T02:47:36.533125Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:2555-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper provides the following fixes:\n\nlibzypp security fixes:\n\n- CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)\n- CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)\n- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows,\n  mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)\n\nlibzypp changes:\n\n- RepoManager: Explicitly request repo2solv to generate application pseudo packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'.\n- libzypp-devel should not require cmake. (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)\n- Avoid zombie tar processes. (bsc#1076192)\n- man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n  Use 'gpg --list-packets' to determine the keyid to verify a signature.\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)\n\nzypper changes:\n\n- download: fix crash when non-package types are passed as argument (bsc#1037210)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n","status":"published","published":"2018-08-30T06:44:57Z","modified":"2026-02-04T03:22:05.877871Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2688-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper fixes the following issues:\n\nlibzypp security fixes:\n\n- PackageProvider: Validate delta rpms before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before caching\n  (bsc#1091624, bsc#1088705, CVE-2018-7685)\n- Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)\n- Fix repo gpg check workflows, mainly for unsigned repos and packages\n  (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)\n\nlibzypp other changes/bugs fixed:\n\n- Update to version 14.45.17\n- RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Use common workflow for downloading packages and srcpackages. This includes a\n  common way of handling and reporting gpg signature and checks. (bsc#1037210)\n- PackageProvider: as well support downloading SrcPackage (for bsc#1037210)\n- Adapt to work with GnuPG 2.1.23 (bsc#1054088)\n- repo refresh: Re-probe if the repository type changes (bsc#1048315)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application pseudo\n  packages.\n- Prefer calling 'repo2solv' rather than 'repo2solv.sh'\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having been been\n  loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n\nzypper security fixes:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735,\n  CVE-2017-9269)\n- Adapt download callback to report and handle unsigned packages (bsc#1038984,\n  CVE-2017-7436)\n\nzypper other changes/bugs fixed:\n\n- Update to version 1.11.70\n- Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- do not recommend cron (bsc#1079334)\n","status":"published","published":"2018-09-11T12:59:55Z","modified":"2026-02-04T03:16:13.216366Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2690-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper, libsolv provides the following fixes:\n\nSecurity fixes in libzypp:\n\n- CVE-2018-7685: PackageProvider: Validate RPMs before caching (bsc#1091624, bsc#1088705)\n- CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)\n\nChanges in libzypp:\n\n- Update to version 17.6.4\n- Automatically fetch repository signing key from gpgkey url (bsc#1088037)\n- lsof: use '-K i' if lsof supports it (bsc#1099847,bsc#1036304)\n- Check for not imported keys after multi key import from rpmdb (bsc#1096217)\n- Flags: make it std=c++14 ready\n- Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)\n- Show GPGME version in log\n- Adapt to changes in libgpgme11-11.1.0 breaking the signature verification (bsc#1100427)\n- RepoInfo::provideKey: add report telling where we look for missing keys.\n- Support listing gpgkey URLs in repo files (bsc#1088037)\n- Add new report to request user approval for importing a package key\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- Add filesize check for downloads with known size (bsc#408814)\n- Removed superfluous space in translation (bsc#1102019)\n- Prevent the system from sleeping during a commit\n- RepoManager: Explicitly request repo2solv to generate application pseudo packages.\n- libzypp-devel should not require cmake (bsc#1101349)\n- Avoid zombies from ExternalProgram\n- Update ApiConfig\n- HardLocksFile: Prevent against empty commit without Target having\n  been been loaded (bsc#1096803)\n- lsof: use '-K i' if lsof supports it (bsc#1099847)\n- Add filesize check for downloads with known size (bsc#408814)\n- Fix detection of metalink downloads and prevent aborting if a metalink file\n  is larger than the expected data file.\n- Require libsolv-devel \u003e= 0.6.35 during build (fixing bsc#1100095)\n- Make use of %license macro (bsc#1082318)\n\nSecurity fix in zypper:\n\n- CVE-2017-9269: Improve signature check callback messages (bsc#1045735)\n\nChanges in zypper:\n\n- Always set error status if any nr of unknown repositories are passed to lr and ref (bsc#1093103)\n- Notify user about unsupported rpm V3 keys in an old rpm database (bsc#1096217)\n- Detect read only filesystem on system modifying operations (fixes #199)\n- Use %license (bsc#1082318)\n- Handle repo aliases containing multiple ':' in the PackageArgs parser (bsc #1041178)\n- Fix broken display of detailed query results.\n- Fix broken search for items with a dash. (bsc#907538, bsc#1043166, bsc#1070770)\n- Disable repository operations when searching installed packages. (bsc#1084525)\n- Prevent nested calls to exit() if aborted by a signal. (bsc#1092413)\n- ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)\n- Fix some translation errors.\n- Support listing gpgkey URLs in repo files (bsc#1088037)\n- Check for root privileges in zypper verify and si (bsc#1058515)\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- Add expert (allow-*) options to all installer commands (bsc#428822)\n- Sort search results by multiple columns (bsc#1066215)\n- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)\n- Set error status if repositories passed to lr and ref are not known (bsc#1093103)\n- Do not override table style in search\n- Fix out of bound read in MbsIterator\n- Add --supplements switch to search and info\n- Add setter functions for zypp cache related config values to ZConfig\n\nChanges in libsolv:\n\n- convert repo2solv.sh script into a binary tool\n- Make use of %license macro (bsc#1082318)\n","status":"published","published":"2018-09-11T13:50:37Z","modified":"2026-02-04T03:21:06.419254Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2716-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper provides the following fixes:\n\nUpdate libzypp to version 16.17.20\n\nSecurity issues fixed:\n\n- PackageProvider: Validate delta rpms before caching (bsc#1091624,\n  bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before\n  caching (bsc#1091624, bsc#1088705, CVE-2018-7685)\n\nOther bugs fixed:\n\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application\n  pseudo packages.\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having\n  been been loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n\nUpdate to zypper to version 1.13.45\n\nSecurity issue fixed:\n- Improve signature check callback messages\n  (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings\n  (bsc#1045735, CVE-2017-9269)\n\nOther bugs fixed:\n\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf,\n  not zypp.conf (bsc#1100028)\n- Prevent nested calls to exit() if aborted by a signal (bsc#1092413)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- Fix: zypper bash completion expands non-existing options (bsc#1049825)\n- do not recommend cron (bsc#1079334)\n- Improve signature check callback messages (bsc#1045735)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735)\n","status":"published","published":"2018-09-14T12:50:52Z","modified":"2026-02-04T02:37:05.778866Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2716-2","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper provides the following fixes:\n\nUpdate libzypp to version 16.17.20\n\nSecurity issues fixed:\n\n- PackageProvider: Validate delta rpms before caching (bsc#1091624,\n  bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before\n  caching (bsc#1091624, bsc#1088705, CVE-2018-7685)\n\nOther bugs fixed:\n\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application\n  pseudo packages.\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having\n  been been loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n\nUpdate to zypper to version 1.13.45\n\nSecurity issue fixed:\n- Improve signature check callback messages\n  (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings\n  (bsc#1045735, CVE-2017-9269)\n\nOther bugs fixed:\n\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf,\n  not zypp.conf (bsc#1100028)\n- Prevent nested calls to exit() if aborted by a signal (bsc#1092413)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- Fix: zypper bash completion expands non-existing options (bsc#1049825)\n- do not recommend cron (bsc#1079334)\n- Improve signature check callback messages (bsc#1045735)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735)\n","status":"published","published":"2018-10-18T12:48:52Z","modified":"2026-02-04T02:27:09.10091Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2814-1","title":"Security update for libzypp, zypper","description":"This update for libzypp, zypper fixes the following issues:\n\nUpdate libzypp to version 16.17.20:\n\nSecurity issues fixed:\n\n- PackageProvider: Validate deta rpms before caching (bsc#1091624,\n  bsc#1088705, CVE-2018-7685)\n- PackageProvider: Validate downloaded rpm package signatures before\n  caching (bsc#1091624, bsc#1088705, CVE-2018-7685)\n\nOther bugs fixed:\n\n- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- RepoManager: Explicitly request repo2solv to generate application\n  pseudo packages.\n- libzypp-devel should not require cmake (bsc#1101349)\n- HardLocksFile: Prevent against empty commit without Target having\n  been been loaded (bsc#1096803)\n- Avoid zombie tar processes (bsc#1076192)\n\nUpdate to zypper to version 1.13.45:\n\nSecurity issues fixed:\n\n- Improve signature check callback messages (bsc#1045735, CVE-2017-9269)\n- add/modify repo: Add options to tune the GPG check settings\n  (bsc#1045735, CVE-2017-9269)\n\nOther bugs fixed:\n\n- XML \u003cinstall-summary\u003e attribute `packages-to-change` added (bsc#1102429)\n- man: Strengthen that `--config FILE' affects zypper.conf,\n  not zypp.conf (bsc#1100028)\n- Prevent nested calls to exit() if aborted by a signal (bsc#1092413)\n- ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)\n- Fix: zypper bash completion expands non-existing options (bsc#1049825)\n- Improve signature check callback messages (bsc#1045735)\n- add/modify repo: Add options to tune the GPG check settings (bsc#1045735)\n","status":"published","published":"2018-09-24T06:06:49Z","modified":"2025-05-02T04:07:09.120042Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}