CVE-2017-9269: high-severity vulnerability in SUSE libzypp
lack of keypinning in libzypp could lead to repository switching
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 2.2%
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
SUSE · libzyppRelated CVEs — SUSE libzypp
In the same product, most dangerous first.
CVE-2017-7436HIGHlibzypp accepts unsigned packages even when configured to check signaturesEPSS 1.8%CVE-2017-7435HIGHlibzypp accepts unsigned 3rd party repo without warningEPSS 1.8%CVE-2026-25707HIGHHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzyppEPSS 0.6%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2026-44942MEDIUMlibzypp .repo files can have an optional path which can lead to path traversal attacksEPSS 0.4%CVE-2018-7685HIGHlibzypp does not reevaluate malicious rpms once downloadedEPSS 0.3%