CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security@opentext.com

Published

2018-03-01

Last modified

2024-09-17

Weaknesses

CWE-20, CWE-757

Affected products

• Libzypp (Opensuse)
• Libzypp (Suse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=1045735
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html
• https://www.suse.com/de-de/security/cve/CVE-2017-9269/