CVE-2017-9269

lack of keypinning in libzypp could lead to repository switching

State: Published
Severity: 7.7 High
Published: Mar 1, 2018
Updated: Sep 17, 2024
Reserved: May 29, 2017

Description

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Scores

CVSS	Score	Vector	Source
3.0	7.7 High	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L	microfocus

Weaknesses

CWE-757

Affected Products

Product	Versions
libzyppSUSE	before 201808Affected

References

SUSE-SU-2017:2040vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1045735
https://www.suse.com/de-de/security/cve/CVE-2017-9269/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.