lack of keypinning in libzypp could lead to repository switching

Published 8 y ago 2018-03-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.7

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.2%

percentile 83%

Public exploits

none known

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Exploit prediction (EPSS)

2.25% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L`
CNA	3.0	7.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L`
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected products

SUSE libzypp

Classification

Weakness

CWE-757 Selection of Less-Secure Algorithm During Negotiation
CWE-20 Improper Input Validation

References

lists.opensuse.org /opensuse-security-announce/2017-08/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
bugzilla.suse.com /show_bug.cgi?id=1045735 · x_refsource_CONFIRM, x_transferred
suse.com /de-de/security/cve/CVE-2017-9269/ · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-9269
NVD: CVE-2017-9269

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.