CVE-2017-7436high

CVE-2017-7436: high-severity vulnerability in SUSE libzypp

libzypp accepts unsigned packages even when configured to check signatures

Published · Updated

Follow this CVE+ Monitor libzypp+ Monitor libzypp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.8%
In short

libzypp was accepting unsigned software packages without warning users, allowing attackers to trick people into installing malicious software by intercepting downloads or compromising servers.

Technical detail

libzypp before 20170803 failed to enforce signature verification for RPM packages, allowing unsigned packages to be installed without user notification. The vulnerability enables man-in-the-middle attacks or compromised repositories to deliver malicious packages when signature checks were expected to be active.

Summary generated and translated by AI from the official description.
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SUSE · libzypp
Related CVEs — SUSE libzypp

In the same product, most dangerous first.

CVE-2017-9269HIGHlack of keypinning in libzypp could lead to repository switchingEPSS 2.2%CVE-2017-7435HIGHlibzypp accepts unsigned 3rd party repo without warningEPSS 1.8%CVE-2026-25707HIGHHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzyppEPSS 0.6%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2026-44942MEDIUMlibzypp .repo files can have an optional path which can lead to path traversal attacksEPSS 0.4%CVE-2018-7685HIGHlibzypp does not reevaluate malicious rpms once downloadedEPSS 0.3%