{"id":"SUSE-SU-2022:1157-1","aliases":[],"status":"published","title":"Security update for libsolv, libzypp, zypper","description":"This update for libsolv, libzypp, zypper fixes the following issues:\n\nSecurity relevant fix:\n\n- Harden package signature checks (bsc#1184501).\n\nlibsolv update to 0.7.22:\n\n- reworked choice rule generation to cover more usecases\n- support SOLVABLE_PREREQ_IGNOREINST in the ordering code (bsc#1196514)\n- support parsing of Debian's Multi-Arch indicator\n- fix segfault on conflict resolution when using bindings\n- fix split provides not working if the update includes a forbidden vendor change\n- support strict repository priorities\n  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY\n- support zstd compressed control files in debian packages\n- add an ifdef allowing to rename Solvable dependency members ('requires' is a keyword in C++20)\n- support setting/reading userdata in solv files\n  new functions: repowriter_set_userdata, solv_read_userdata\n- support queying of the custom vendor check function\n  new function: pool_get_custom_vendorcheck\n- support solv files with an idarray block\n- allow accessing the toolversion at runtime\n\nlibzypp update to 17.30.0:\n\n- ZConfig: Update solver settings if target changes (bsc#1196368)\n- Fix possible hang in singletrans mode (bsc#1197134)\n- Do 2 retries if mount is still busy.\n- Fix package signature check (bsc#1184501)\n  Pay attention that header and payload are secured by a valid\n  signature and report more detailed which signature is missing.\n- Retry umount if device is busy (bsc#1196061, closes #381)\n  A previously released ISO image may need a bit more time to\n  release it's loop device. So we wait a bit and retry.\n- Fix serializing/deserializing type mismatch in zypp-rpm protocol (bsc#1196925)\n- Fix handling of ISO media in releaseAll (bsc#1196061)\n- Hint on common ptf resolver conflicts (bsc#1194848)\n- Hint on ptf\u003c\u003epatch resolver conflicts (bsc#1194848)\n\nzypper update to 1.14.52:\n\n- info: print the packages upstream URL if available (fixes #426)\n- info: Fix SEGV with not installed PTFs (bsc#1196317)\n- Don't prevent less restrictive umasks (bsc#1195999)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-12T11:26:56Z","modified":"2022-04-12T11:26:56Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP2","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP2","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libsolv","fixed_in":["0.7.22-150200.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libzypp","fixed_in":["17.30.0-150200.36.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"zypper","fixed_in":["1.14.52-150200.30.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP2","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-150200.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.30.0-150200.36.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"zypper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-150200.30.2"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221157-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184501","tags":["report"]},{"url":"https://bugzilla.suse.com/1194848","tags":["report"]},{"url":"https://bugzilla.suse.com/1195999","tags":["report"]},{"url":"https://bugzilla.suse.com/1196061","tags":["report"]},{"url":"https://bugzilla.suse.com/1196317","tags":["report"]},{"url":"https://bugzilla.suse.com/1196368","tags":["report"]},{"url":"https://bugzilla.suse.com/1196514","tags":["report"]},{"url":"https://bugzilla.suse.com/1196925","tags":["report"]},{"url":"https://bugzilla.suse.com/1197134","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2022:1157-1","title":"Security update for libsolv, libzypp, zypper","description":"This update for libsolv, libzypp, zypper fixes the following issues:\n\nSecurity relevant fix:\n\n- Harden package signature checks (bsc#1184501).\n\nlibsolv update to 0.7.22:\n\n- reworked choice rule generation to cover more usecases\n- support SOLVABLE_PREREQ_IGNOREINST in the ordering code (bsc#1196514)\n- support parsing of Debian's Multi-Arch indicator\n- fix segfault on conflict resolution when using bindings\n- fix split provides not working if the update includes a forbidden vendor change\n- support strict repository priorities\n  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY\n- support zstd compressed control files in debian packages\n- add an ifdef allowing to rename Solvable dependency members ('requires' is a keyword in C++20)\n- support setting/reading userdata in solv files\n  new functions: repowriter_set_userdata, solv_read_userdata\n- support queying of the custom vendor check function\n  new function: pool_get_custom_vendorcheck\n- support solv files with an idarray block\n- allow accessing the toolversion at runtime\n\nlibzypp update to 17.30.0:\n\n- ZConfig: Update solver settings if target changes (bsc#1196368)\n- Fix possible hang in singletrans mode (bsc#1197134)\n- Do 2 retries if mount is still busy.\n- Fix package signature check (bsc#1184501)\n  Pay attention that header and payload are secured by a valid\n  signature and report more detailed which signature is missing.\n- Retry umount if device is busy (bsc#1196061, closes #381)\n  A previously released ISO image may need a bit more time to\n  release it's loop device. So we wait a bit and retry.\n- Fix serializing/deserializing type mismatch in zypp-rpm protocol (bsc#1196925)\n- Fix handling of ISO media in releaseAll (bsc#1196061)\n- Hint on common ptf resolver conflicts (bsc#1194848)\n- Hint on ptf\u003c\u003epatch resolver conflicts (bsc#1194848)\n\nzypper update to 1.14.52:\n\n- info: print the packages upstream URL if available (fixes #426)\n- info: Fix SEGV with not installed PTFs (bsc#1196317)\n- Don't prevent less restrictive umasks (bsc#1195999)\n","status":"published","published":"2022-04-12T11:26:56Z","modified":"2022-04-12T11:26:56Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}