PT-2018-8493 · Opensuse+1 · Libzypp+1

Moritz Duge + 1 · Published 2017-08-03 · Updated 2024-06-15 · CVE-2017-9269

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions libzypp versions prior to August 2018

Description The issue concerns the incorrect pinning of GPG keys attached to YUM repositories in libzypp, allowing malicious repository mirrors to silently downgrade to unsigned repositories. This could potentially lead to the distribution of malicious content.

Recommendations For versions prior to August 2018, ensure that GPG keys are properly pinned to prevent malicious repository mirrors from downgrading to unsigned repositories. As a temporary workaround, consider restricting access to repository mirrors to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-757

CWE-20

Related Identifiers

CVE-2017-9269

OPENSUSE-SU-2017_2111-1

OPENSUSE-SU-2017_2335-1

OPENSUSE-SU-2018_2739-1

OPENSUSE-SU-2024:11019-1

OPENSUSE-SU-2024:11545-1

SUSE-SU-2017:2040-1

SUSE-SU-2017:2264-1

SUSE-SU-2018:2555-1

SUSE-SU-2018:2688-1

SUSE-SU-2018:2690-1

SUSE-SU-2018:2716-1

SUSE-SU-2018:2716-2

SUSE-SU-2018:2814-1

SUSE-SU-2018_2690-1

SUSE-SU-2018_2716-1

SUSE-SU-2018_2716-2

SUSE-SU-2018_2814-1

Affected Products

Suse

Libzypp

References · 77

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9269 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2716-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9269 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-9269 · Vendor Advisory
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9269 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11019-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2690-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2814-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9269 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2688-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2264-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9269 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9269 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2040-1 · Vendor Advisory