CVE-2017-7436 libzypp accepts unsigned packages even when configured to check signatures
HighCVSS 8.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libzypp(Debian:12) | < 17.3.1-1 | 17.3.1-1 |
| debian/libzypp(Debian:13) | < 17.3.1-1 | 17.3.1-1 |
| debian/libzypp(Debian:14) | < 17.3.1-1 | 17.3.1-1 |
| openSUSE libzypp | <= 16.15.2 | No fix listed |
| SUSE libzypp | < 20170803 | 20170803 |
References
- Debian Security Tracker CVE-2017-7436 vendor-advisory
- bugzilla.suse.com
- SUSE-SU-2017:2040 vendor-advisory
- www.suse.com
- bugs.debian.org issue-tracking