Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2344-1

Опубликовано: 04 сент. 2017
Источник: suse-cvrf

Описание

Security update for libzypp, zypper

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

  • Adapt to work with GnuPG 2.1.23. (bsc#1054088)
  • Support signing with subkeys. (bsc#1008325)
  • Enhance sort order for media.1/products. (bsc#1054671)

zypper:

  • Also show a gpg key's subkeys. (bsc#1008325)
  • Improve signature check callback messages. (bsc#1045735)
  • Add options to tune the GPG check settings. (bsc#1045735)
  • Adapt download callback to report and handle unsigned packages. (bsc#1038984, CVE-2017-7436)
  • Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
libzypp-16.15.6-2.8.1
zypper-1.13.32-21.3.2
zypper-log-1.13.32-21.3.2
SUSE Linux Enterprise Server 12 SP3
libzypp-16.15.6-2.8.1
zypper-1.13.32-21.3.2
zypper-log-1.13.32-21.3.2
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libzypp-16.15.6-2.8.1
zypper-1.13.32-21.3.2
zypper-log-1.13.32-21.3.2
SUSE Linux Enterprise Software Development Kit 12 SP3
libzypp-devel-16.15.6-2.8.1
libzypp-devel-doc-16.15.6-2.8.1

Ссылки

Описание

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:libzypp-16.15.6-2.8.1
SUSE Linux Enterprise Desktop 12 SP3:zypper-1.13.32-21.3.2
SUSE Linux Enterprise Desktop 12 SP3:zypper-log-1.13.32-21.3.2
SUSE Linux Enterprise Server 12 SP3:libzypp-16.15.6-2.8.1
Ссылки