Unrated severityNVD Advisory· Published Mar 1, 2018· Updated Sep 17, 2024
lack of keypinning in libzypp could lead to repository switching
CVE-2017-9269
Description
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
42- osv-coords40 versionspkg:rpm/opensuse/libzypp&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/zypper&distro=openSUSE%20Tumbleweedpkg:rpm/suse/libsolv&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/libsolv&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015pkg:rpm/suse/libzypp&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/libzypp&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/yast2-pkg-bindings-devel-doc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/yast2-pkg-bindings&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/yast2-pkg-bindings&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/yast2-pkg-bindings&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/zypper&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/zypper&distro=SUSE%20OpenStack%20Cloud%207
< 17.28.4-1.2+ 39 more
- (no CPE)range: < 17.28.4-1.2
- (no CPE)range: < 1.14.49-1.2
- (no CPE)range: < 0.6.35-3.5.2
- (no CPE)range: < 0.6.35-3.5.2
- (no CPE)range: < 16.17.20-27.52.1
- (no CPE)range: < 16.15.2-27.21.1
- (no CPE)range: < 16.15.3-2.3.1
- (no CPE)range: < 17.6.4-3.10.1
- (no CPE)range: < 15.25.17-46.22.1
- (no CPE)range: < 16.15.2-27.21.1
- (no CPE)range: < 16.17.20-27.52.1
- (no CPE)range: < 16.17.20-27.52.1
- (no CPE)range: < 16.15.3-2.3.1
- (no CPE)range: < 14.45.17-2.82.1
- (no CPE)range: < 16.15.2-27.21.1
- (no CPE)range: < 15.25.17-46.22.1
- (no CPE)range: < 16.15.2-27.21.1
- (no CPE)range: < 16.15.3-2.3.1
- (no CPE)range: < 16.15.2-27.21.1
- (no CPE)range: < 16.15.3-2.3.1
- (no CPE)range: < 16.17.20-27.52.1
- (no CPE)range: < 3.2.4-2.3.1
- (no CPE)range: < 3.2.4-2.3.1
- (no CPE)range: < 3.2.4-2.3.1
- (no CPE)range: < 3.2.4-2.3.1
- (no CPE)range: < 1.13.45-18.33.1
- (no CPE)range: < 1.13.30-18.13.3
- (no CPE)range: < 1.13.45-21.21.2
- (no CPE)range: < 1.14.10-3.7.1
- (no CPE)range: < 1.12.59-46.10.1
- (no CPE)range: < 1.13.30-18.13.3
- (no CPE)range: < 1.13.45-18.33.1
- (no CPE)range: < 1.13.45-18.33.1
- (no CPE)range: < 1.13.45-21.21.2
- (no CPE)range: < 1.11.70-2.69.2
- (no CPE)range: < 1.13.30-18.13.3
- (no CPE)range: < 1.12.59-46.10.1
- (no CPE)range: < 1.13.30-18.13.3
- (no CPE)range: < 1.13.45-21.21.2
- (no CPE)range: < 1.13.45-18.33.1
- SUSE/libzyppv5Range: unspecified
Patches
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
3- lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.htmlmitrevendor-advisoryx_refsource_SUSE
- bugzilla.suse.com/show_bug.cgimitrex_refsource_CONFIRM
- www.suse.com/de-de/security/cve/CVE-2017-9269/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.