Critical severity · published Mar 1, 2018
CVE-2017-9269
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories…
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libzypp · Opensuse
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9269
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1045735
lists.opensuse.org
https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html
www.suse.com
https://www.suse.com/de-de/security/cve/CVE-2017-9269/
More from Libzypp
8.8
CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml
8.8
CVE-2026-25707
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
8.1
CVE-2017-7436
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject…
8.1
CVE-2017-7435
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject…
7.8
CVE-2018-7685
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted…