libzypp accepts unsigned 3rd party repo without warning
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 1.8%
exploitation probability
1.8%top 23% of all CVEs
observed exploitation
nono source reports it
In short
libzypp allowed users to add YUM repositories without verifying their authenticity, meaning attackers could trick users into installing malicious software without any warning or verification.
Technical detail
libzypp versions prior to 20170803 accepted unsigned YUM repository configurations without cryptographic verification or user notification. An attacker could perform a MITM attack or compromise a repository server to inject malicious RPM packages, as the package manager lacked signature validation and user warnings for unsigned third-party repositories.
Summary generated and translated by AI from the official description.
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SUSE · libzypp