CVE-2017-9271 proxy credentials written to log files by zypper
LowCVSS 3.3
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/zypper(Ubuntu:22.04) | All versions | No fix listed |
| debian/libzypp(Debian:12) | < 17.25.5-2 | 17.25.5-2 |
| debian/libzypp(Debian:13) | < 17.25.5-2 | 17.25.5-2 |
| debian/libzypp(Debian:14) | < 17.25.5-2 | 17.25.5-2 |
| openSUSE zypper | All versions | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| ubuntu/zypper(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/zypper(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/zypper(Ubuntu:26.10) | All versions | No fix listed |
| SUSE zypper | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-9271 vendor-advisory
- bugzilla.suse.com
- FEDORA-2021-ebc1c35c5d vendor-advisory
- www.suse.com
- bugs.debian.org issue-tracking