PT-2018-8379 · Opensuse+1 · Libzypp+1

Ludwig Nussel · Publicado 2017-08-03 · Atualizado 2024-06-15 · CVE-2017-7435

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libzypp versions prior to 20170803

Description The issue allows unsigned YUM repositories to be added without warning the user, which could lead to man-in-the-middle attacks or malicious servers injecting malicious RPM packages into a user's system.

Recommendations For versions prior to 20170803, update to version 20170803 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-7435

OPENSUSE-SU-2017_2111-1

OPENSUSE-SU-2017_2335-1

OPENSUSE-SU-2024:11019-1

SUSE-SU-2017:2040-1

SUSE-SU-2017:2264-1

SUSE-SU-2017_2040-1

SUSE-SU-2017_2264-1

SUSE-SU-2018:2555-1

SUSE-SU-2018:2688-1

SUSE-SU-2018_2555-1

SUSE-SU-2018_2688-1

Produtos afetados

Suse

Libzypp

Referências · 61

• https://bugzilla.suse.com/show_bug.cgi?id=1009127 · Nota
• https://bugzilla.suse.com/1102429 · Nota
• https://bugzilla.suse.com/1038984 · Nota
• https://suse.com/security/cve/CVE-2019-18900 · Nota
• https://suse.com/security/cve/CVE-2017-7435.html · Nota
• https://bugzilla.suse.com/1046417 · Nota
• https://bugzilla.suse.com/1036304 · Nota
• https://bugzilla.suse.com/1070851 · Nota
• https://bugzilla.suse.com/1036659 · Nota
• https://ubuntu.com/security/CVE-2017-7435 · Aviso do Fabricante
• https://lists.suse.com/pipermail/sle-security-updates/2017-August/003160.html · Nota
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html · Aviso do Fabricante
• https://bugzilla.suse.com/1031756 · Nota
• https://bugzilla.suse.com/1088705 · Nota
• https://bugzilla.suse.com/1048315 · Nota