CVE-2017-9269
Published: 1 March 2018
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libzypp Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Does not exist
|
|
| cosmic |
Not vulnerable
(17.6.1-1)
|
|
| disco |
Not vulnerable
(17.6.1-1)
|
|
| eoan |
Not vulnerable
(17.6.1-1)
|
|
| focal |
Not vulnerable
(17.6.1-1)
|
|
| groovy |
Does not exist
|
|
| hirsute |
Not vulnerable
(17.6.1-1)
|
|
| impish |
Not vulnerable
(17.6.1-1)
|
|
| jammy |
Not vulnerable
(17.6.1-1)
|
|
| kinetic |
Not vulnerable
(17.6.1-1)
|
|
| lunar |
Not vulnerable
(17.6.1-1)
|
|
| mantic |
Not vulnerable
(17.6.1-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(17.3.1-1)
|
|
| xenial |
Needed
|
|
| zesty |
Ignored
(end of life)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |