Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2264-1

Опубликовано: 25 авг. 2017
Источник: suse-cvrf

Описание

Security update for libzypp

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

  • CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)
  • Fix gpg-pubkey release (creation time) computation. (bsc#1036659)
  • Update lsof blacklist. (bsc#1046417)
  • Re-probe on refresh if the repository type changes. (bsc#1048315)
  • Propagate proper error code to DownloadProgressReport. (bsc#1047785)
  • Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
  • Support custom repo variables defined in /etc/zypp/vars.d.

yast2-pkg-bindings:

  • Do not crash when the repository URL is not defined. (bsc#1043218)

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
libzypp-16.15.3-2.3.1
yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Server 12 SP3
libzypp-16.15.3-2.3.1
yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libzypp-16.15.3-2.3.1
yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Software Development Kit 12 SP3
libzypp-devel-16.15.3-2.3.1
libzypp-devel-doc-16.15.3-2.3.1
yast2-pkg-bindings-devel-doc-3.2.4-2.3.1

Ссылки

Описание

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Desktop 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Server 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Server 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
Ссылки

Описание

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Desktop 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Server 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Server 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
Ссылки

Описание

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Desktop 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Server 12 SP3:libzypp-16.15.3-2.3.1
SUSE Linux Enterprise Server 12 SP3:yast2-pkg-bindings-3.2.4-2.3.1
Ссылки
Уязвимость SUSE-SU-2017:2264-1