CVE-2017-9269: lack of keypinning in libzypp could lead to repository switching
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-9269?
CVE-2017-9269 is a vulnerability in libzypp that allowed malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
What is the severity of CVE-2017-9269?
CVE-2017-9269 has a severity rating of 9.8 (critical).
Which software is affected by CVE-2017-9269?
Opensuse Libzypp is affected by CVE-2017-9269.
How can I fix CVE-2017-9269?
To fix CVE-2017-9269, it is recommended to update libzypp to a version released after August 2018.
Where can I find more information about CVE-2017-9269?
You can find more information about CVE-2017-9269 at the following references: - [Bugzilla SUSE](https://bugzilla.suse.com/show_bug.cgi?id=1045735) - [OpenSUSE Security Announce](https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html) - [SUSE CVE](https://www.suse.com/de-de/security/cve/CVE-2017-9269/)