CVE-2017-7435: high-severity vulnerability in SUSE libzypp
libzypp accepts unsigned 3rd party repo without warning
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
libzypp allowed users to add YUM repositories without verifying their authenticity, meaning attackers could trick users into installing malicious software without any warning or verification.
libzypp versions prior to 20170803 accepted unsigned YUM repository configurations without cryptographic verification or user notification. An attacker could perform a MITM attack or compromise a repository server to inject malicious RPM packages, as the package manager lacked signature validation and user warnings for unsigned third-party repositories.
In the same product, most dangerous first.