PT-2018-8380 · Opensuse+1 · Libzypp+1

Forgotten User + 1 · Published 2017-08-03 · Updated 2024-06-15 · CVE-2017-7436

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libzypp versions prior to 20170803

Description The issue allows an attacker to retrieve unsigned packages without warning the user, which could lead to a man-in-the-middle attack or malicious servers injecting malicious RPM packages into a user's system.

Recommendations For versions prior to 20170803, update to a version newer than 20170803 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-7436

OPENSUSE-SU-2017_2111-1

OPENSUSE-SU-2017_2335-1

OPENSUSE-SU-2017_2370-1

OPENSUSE-SU-2024:11545-1

SUSE-SU-2017:2040-1

SUSE-SU-2017:2264-1

SUSE-SU-2017:2344-1

SUSE-SU-2017_2344-1

SUSE-SU-2018:2555-1

SUSE-SU-2018:2688-1

Affected Products

Suse

Libzypp

References · 61

• https://cve.org/CVERecord?id=CVE-2017-7436 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7436 · Vendor Advisory
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7436 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2688-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2040-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7436 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7436 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:2264-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11545-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2344-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7436 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2555-1 · Vendor Advisory
• https://bugzilla.suse.com/1102429 · Note