High severity · published Mar 1, 2018
CVE-2017-7435
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject…
8.1
CVSS
1.8%
EPSS
No
On KEV
Description
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libzypp · Opensuse
through 16.15.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7435
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1009127
lists.opensuse.org
https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html
www.suse.com
https://www.suse.com/de-de/security/cve/CVE-2017-7435/
More from Libzypp
9.8
CVE-2017-9269
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories…
8.8
CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml
8.8
CVE-2026-25707
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
8.1
CVE-2017-7436
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject…
7.8
CVE-2018-7685
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted…