CVE-2017-7435 libzypp accepts unsigned 3rd party repo without warning
HighCVSS 8.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libzypp(Debian:12) | < 17.3.1-1 | 17.3.1-1 |
| debian/libzypp(Debian:13) | < 17.3.1-1 | 17.3.1-1 |
| debian/libzypp(Debian:14) | < 17.3.1-1 | 17.3.1-1 |
| openSUSE libzypp | <= 16.15.2 | No fix listed |
| SUSE libzypp | < 20170803 | 20170803 |
References
- Debian Security Tracker CVE-2017-7435 vendor-advisory
- bugzilla.suse.com
- SUSE-SU-2017:2040 vendor-advisory
- www.suse.com
- bugs.debian.org issue-tracking