Описание
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libzypp | fixed | 17.38.12-1 | package | |
| libzypp | no-dsa | trixie | package | |
| libzypp | not-affected | bookworm | package | |
| libzypp | not-affected | bullseye | package |
Примечания
Fixed by: https://github.com/openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04 (17.38.12)
Introduced with: https://github.com/openSUSE/libzypp/commit/beb0e764a86e7effc13cde04ff3db652c5c758a4 (17.26.0)
EPSS
Связанные уязвимости
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Уязвимость механизма обработки файла метаданных репозитория repomd.xml библиотеки libzypp, позволяющая нарушителю выполнить произвольный код
EPSS