Описание
Security update for libzypp
The Software Update Stack was updated to receive fixes and enhancements.
libzypp:
- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)
- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)
- Update lsof blacklist. (bsc#1046417)
- Re-probe on refresh if the repository type changes. (bsc#1048315)
- Propagate proper error code to DownloadProgressReport. (bsc#1047785)
- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
- Support custom repo variables defined in /etc/zypp/vars.d.
yast2-pkg-bindings:
- Do not crash when the repository URL is not defined. (bsc#1043218)
This update was imported from the SUSE:SLE-12-SP3:Update update project.
Список пакетов
openSUSE Leap 42.3
Ссылки
- E-Mail link for openSUSE-SU-2017:2335-1
- SUSE Security Ratings
Описание
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Затронутые продукты
Ссылки
- CVE-2017-7435
- SUSE Bug 1009127
- SUSE Bug 1038984
- SUSE Bug 1045735
Описание
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Затронутые продукты
Ссылки
- CVE-2017-7436
- SUSE Bug 1008325
- SUSE Bug 1009127
- SUSE Bug 1038984
- SUSE Bug 1045735
Описание
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Затронутые продукты
Ссылки
- CVE-2017-9269
- SUSE Bug 1038984
- SUSE Bug 1045735