Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2040-1

Опубликовано: 03 авг. 2017
Источник: suse-cvrf

Описание

Security update for libzypp, zypper

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

Security issues fixed:

  • CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)

Bug fixes:

  • Re-probe on refresh if the repository type changes. (bsc#1048315)
  • Propagate proper error code to DownloadProgressReport. (bsc#1047785)
  • Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
  • Support custom repo variables defined in /etc/zypp/vars.d.
  • Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)
  • Fix potential crash if repository has no baseurl. (bsc#1043218)

zypper:

  • Adapt download callback to report and handle unsigned packages. (bsc#1038984)
  • Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)
  • Document support for custom repository variables defined in /etc/zypp/vars.d.
  • Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent if PK blocks package management.

Список пакетов

SUSE Linux Enterprise Desktop 12 SP2
libzypp-16.15.2-27.21.1
zypper-1.13.30-18.13.3
zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server 12 SP2
libzypp-16.15.2-27.21.1
zypper-1.13.30-18.13.3
zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
libzypp-16.15.2-27.21.1
zypper-1.13.30-18.13.3
zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server for SAP Applications 12 SP2
libzypp-16.15.2-27.21.1
zypper-1.13.30-18.13.3
zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Software Development Kit 12 SP2
libzypp-devel-16.15.2-27.21.1
libzypp-devel-doc-16.15.2-27.21.1

Ссылки

Описание

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libzypp-16.15.2-27.21.1
SUSE Linux Enterprise Desktop 12 SP2:zypper-1.13.30-18.13.3
SUSE Linux Enterprise Desktop 12 SP2:zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server 12 SP2:libzypp-16.15.2-27.21.1
Ссылки

Описание

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libzypp-16.15.2-27.21.1
SUSE Linux Enterprise Desktop 12 SP2:zypper-1.13.30-18.13.3
SUSE Linux Enterprise Desktop 12 SP2:zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server 12 SP2:libzypp-16.15.2-27.21.1
Ссылки

Описание

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libzypp-16.15.2-27.21.1
SUSE Linux Enterprise Desktop 12 SP2:zypper-1.13.30-18.13.3
SUSE Linux Enterprise Desktop 12 SP2:zypper-log-1.13.30-18.13.3
SUSE Linux Enterprise Server 12 SP2:libzypp-16.15.2-27.21.1
Ссылки
Уязвимость SUSE-SU-2017:2040-1