CVE-2017-9269

lack of keypinning in libzypp could lead to repository switching

CVSS 7.7 HIGHEPSS 2.3%CWE-757

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Productos afectados

SUSE · libzypp

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://bugzilla.suse.com/show_bug.cgi?id=1045735 https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html https://www.suse.com/de-de/security/cve/CVE-2017-9269/