Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:2370-1

Опубликовано: 05 сент. 2017
Источник: suse-cvrf

Описание

Security update for libzypp, zypper

The Software Update Stack was updated to receive fixes and enhancements.

libzypp:

  • Adapt to work with GnuPG 2.1.23. (bsc#1054088)
  • Support signing with subkeys. (bsc#1008325)
  • Enhance sort order for media.1/products. (bsc#1054671)

zypper:

  • Also show a gpg key's subkeys. (bsc#1008325)
  • Improve signature check callback messages. (bsc#1045735)
  • Add options to tune the GPG check settings. (bsc#1045735)
  • Adapt download callback to report and handle unsigned packages. (bsc#1038984, CVE-2017-7436)
  • Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Список пакетов

openSUSE Leap 42.3
libzypp-16.15.6-12.1
libzypp-devel-16.15.6-12.1
libzypp-devel-doc-16.15.6-12.1
zypper-1.13.32-8.1
zypper-aptitude-1.13.32-8.1
zypper-log-1.13.32-8.1

Ссылки

Описание

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Затронутые продукты
openSUSE Leap 42.3:libzypp-16.15.6-12.1
openSUSE Leap 42.3:libzypp-devel-16.15.6-12.1
openSUSE Leap 42.3:libzypp-devel-doc-16.15.6-12.1
openSUSE Leap 42.3:zypper-1.13.32-8.1
Ссылки