lack of keypinning in libzypp could lead to repository switching
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 2.3%
exploitation probability
2.3%top 19% of all CVEs
observed exploitation
nono source reports it
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
SUSE · libzypp