csaf_opensuse - opensuse-su-2024:11019-1

opensuse-su-2024:11019-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

libzypp-17.28.4-1.2 on GA media

Notes

Title of the patch

libzypp-17.28.4-1.2 on GA media

Description of the patch

These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-11019

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libzypp-17.28.4-1.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11019",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11019-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-7435 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-7435/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-9269 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-9269/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-9271 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-9271/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-7685 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-7685/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-18900 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-18900/"
      }
    ],
    "title": "libzypp-17.28.4-1.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11019-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libzypp-17.28.4-1.2.aarch64",
                "product": {
                  "name": "libzypp-17.28.4-1.2.aarch64",
                  "product_id": "libzypp-17.28.4-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-17.28.4-1.2.aarch64",
                "product": {
                  "name": "libzypp-devel-17.28.4-1.2.aarch64",
                  "product_id": "libzypp-devel-17.28.4-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-doc-17.28.4-1.2.aarch64",
                "product": {
                  "name": "libzypp-devel-doc-17.28.4-1.2.aarch64",
                  "product_id": "libzypp-devel-doc-17.28.4-1.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libzypp-17.28.4-1.2.ppc64le",
                "product": {
                  "name": "libzypp-17.28.4-1.2.ppc64le",
                  "product_id": "libzypp-17.28.4-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-17.28.4-1.2.ppc64le",
                "product": {
                  "name": "libzypp-devel-17.28.4-1.2.ppc64le",
                  "product_id": "libzypp-devel-17.28.4-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-doc-17.28.4-1.2.ppc64le",
                "product": {
                  "name": "libzypp-devel-doc-17.28.4-1.2.ppc64le",
                  "product_id": "libzypp-devel-doc-17.28.4-1.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libzypp-17.28.4-1.2.s390x",
                "product": {
                  "name": "libzypp-17.28.4-1.2.s390x",
                  "product_id": "libzypp-17.28.4-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-17.28.4-1.2.s390x",
                "product": {
                  "name": "libzypp-devel-17.28.4-1.2.s390x",
                  "product_id": "libzypp-devel-17.28.4-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-doc-17.28.4-1.2.s390x",
                "product": {
                  "name": "libzypp-devel-doc-17.28.4-1.2.s390x",
                  "product_id": "libzypp-devel-doc-17.28.4-1.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libzypp-17.28.4-1.2.x86_64",
                "product": {
                  "name": "libzypp-17.28.4-1.2.x86_64",
                  "product_id": "libzypp-17.28.4-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-17.28.4-1.2.x86_64",
                "product": {
                  "name": "libzypp-devel-17.28.4-1.2.x86_64",
                  "product_id": "libzypp-devel-17.28.4-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libzypp-devel-doc-17.28.4-1.2.x86_64",
                "product": {
                  "name": "libzypp-devel-doc-17.28.4-1.2.x86_64",
                  "product_id": "libzypp-devel-doc-17.28.4-1.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-17.28.4-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64"
        },
        "product_reference": "libzypp-17.28.4-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-17.28.4-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le"
        },
        "product_reference": "libzypp-17.28.4-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-17.28.4-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x"
        },
        "product_reference": "libzypp-17.28.4-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-17.28.4-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64"
        },
        "product_reference": "libzypp-17.28.4-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-17.28.4-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64"
        },
        "product_reference": "libzypp-devel-17.28.4-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-17.28.4-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le"
        },
        "product_reference": "libzypp-devel-17.28.4-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-17.28.4-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x"
        },
        "product_reference": "libzypp-devel-17.28.4-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-17.28.4-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64"
        },
        "product_reference": "libzypp-devel-17.28.4-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-doc-17.28.4-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64"
        },
        "product_reference": "libzypp-devel-doc-17.28.4-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-doc-17.28.4-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le"
        },
        "product_reference": "libzypp-devel-doc-17.28.4-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-doc-17.28.4-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x"
        },
        "product_reference": "libzypp-devel-doc-17.28.4-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzypp-devel-doc-17.28.4-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        },
        "product_reference": "libzypp-devel-doc-17.28.4-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-7435",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-7435"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-7435",
          "url": "https://www.suse.com/security/cve/CVE-2017-7435"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009127 for CVE-2017-7435",
          "url": "https://bugzilla.suse.com/1009127"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1038984 for CVE-2017-7435",
          "url": "https://bugzilla.suse.com/1038984"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1045735 for CVE-2017-7435",
          "url": "https://bugzilla.suse.com/1045735"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-7435"
    },
    {
      "cve": "CVE-2017-9269",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-9269"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-9269",
          "url": "https://www.suse.com/security/cve/CVE-2017-9269"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1038984 for CVE-2017-9269",
          "url": "https://bugzilla.suse.com/1038984"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1045735 for CVE-2017-9269",
          "url": "https://bugzilla.suse.com/1045735"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-9269"
    },
    {
      "cve": "CVE-2017-9271",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-9271"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-9271",
          "url": "https://www.suse.com/security/cve/CVE-2017-9271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1050625 for CVE-2017-9271",
          "url": "https://bugzilla.suse.com/1050625"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-9271"
    },
    {
      "cve": "CVE-2018-7685",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-7685"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-7685",
          "url": "https://www.suse.com/security/cve/CVE-2018-7685"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1045735 for CVE-2018-7685",
          "url": "https://bugzilla.suse.com/1045735"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1088705 for CVE-2018-7685",
          "url": "https://bugzilla.suse.com/1088705"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091624 for CVE-2018-7685",
          "url": "https://bugzilla.suse.com/1091624"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-7685"
    },
    {
      "cve": "CVE-2019-18900",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-18900"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": ": Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
          "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-18900",
          "url": "https://www.suse.com/security/cve/CVE-2019-18900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1158763 for CVE-2019-18900",
          "url": "https://bugzilla.suse.com/1158763"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-17.28.4-1.2.x86_64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.aarch64",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.ppc64le",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.s390x",
            "openSUSE Tumbleweed:libzypp-devel-doc-17.28.4-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-18900"
    }
  ]
}

CVE-2017-9271 (GCVE-0-2017-9271)

Vulnerability from cvelistv5

Published

2018-03-01 19:00

Modified

2024-09-16 23:26

Severity ?

4.0 (Medium) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

Proxy credentials are writting into logfiles
CVE-532

Summary

The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.

References

►

URL

Tags

	https://www.suse.com/de-de/security/cve/CVE-2017-9271/	x_refsource_CONFIRM
	https://bugzilla.suse.com/show_bug.cgi?id=1050625	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VP2DNHXEQFHXBCTSREPNR7BU4EX64SQG/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	SUSE	zypper	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:02:44.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9271/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1050625"
          },
          {
            "name": "FEDORA-2021-ebc1c35c5d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VP2DNHXEQFHXBCTSREPNR7BU4EX64SQG/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zypper",
          "vendor": "SUSE",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mario Biberhofer"
        }
      ],
      "datePublic": "2018-03-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Proxy credentials are writting into logfiles",
              "lang": "en",
              "type": "text"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CVE-532",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-13T03:06:06",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9271/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1050625"
        },
        {
          "name": "FEDORA-2021-ebc1c35c5d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VP2DNHXEQFHXBCTSREPNR7BU4EX64SQG/"
        }
      ],
      "source": {
        "defect": [
          "https://bugzilla.suse.com/show_bug.cgi?id=1050625"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "proxy credentials written to log files by zypper",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "DATE_PUBLIC": "2018-03-01T00:00:00.000Z",
          "ID": "CVE-2017-9271",
          "STATE": "PUBLIC",
          "TITLE": "proxy credentials written to log files by zypper"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "zypper",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Mario Biberhofer"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Proxy credentials are writting into logfiles"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CVE-532"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.suse.com/de-de/security/cve/CVE-2017-9271/",
              "refsource": "CONFIRM",
              "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9271/"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1050625",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1050625"
            },
            {
              "name": "FEDORA-2021-ebc1c35c5d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VP2DNHXEQFHXBCTSREPNR7BU4EX64SQG/"
            }
          ]
        },
        "source": {
          "defect": [
            "https://bugzilla.suse.com/show_bug.cgi?id=1050625"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2017-9271",
    "datePublished": "2018-03-01T19:00:00Z",
    "dateReserved": "2017-05-29T00:00:00",
    "dateUpdated": "2024-09-16T23:26:26.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7435 (GCVE-0-2017-7435)

Vulnerability from cvelistv5

Published

2018-03-01 19:00

Modified

2024-09-16 22:14

Severity ?

8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Missing UI interaction when adding untrusted repositories could lead to use of unsigned package repositories.

Summary

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

References

►

URL

Tags

	https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://www.suse.com/de-de/security/cve/CVE-2017-7435/	x_refsource_CONFIRM
	https://bugzilla.suse.com/show_bug.cgi?id=1009127	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	SUSE	libzypp	Version: unspecified < 20170803

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2017:2040",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.suse.com/de-de/security/cve/CVE-2017-7435/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1009127"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libzypp",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "20170803",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ludwig Nussel of SUSE"
        }
      ],
      "datePublic": "2017-08-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing UI interaction when adding untrusted repositories could lead to use of unsigned package repositories.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-06T16:16:05",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "name": "SUSE-SU-2017:2040",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.suse.com/de-de/security/cve/CVE-2017-7435/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1009127"
        }
      ],
      "source": {
        "advisory": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html",
        "defect": [
          "https://bugzilla.suse.com/show_bug.cgi?id=1009127"
        ],
        "discovery": "INTERNAL"
      },
      "title": "libzypp accepts unsigned 3rd party repo without warning",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "DATE_PUBLIC": "2017-08-03T00:00:00.000Z",
          "ID": "CVE-2017-7435",
          "STATE": "PUBLIC",
          "TITLE": "libzypp accepts unsigned 3rd party repo without warning"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libzypp",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "20170803"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ludwig Nussel of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Missing UI interaction when adding untrusted repositories could lead to use of unsigned package repositories."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2017:2040",
              "refsource": "SUSE",
              "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
            },
            {
              "name": "https://www.suse.com/de-de/security/cve/CVE-2017-7435/",
              "refsource": "CONFIRM",
              "url": "https://www.suse.com/de-de/security/cve/CVE-2017-7435/"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1009127",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1009127"
            }
          ]
        },
        "source": {
          "advisory": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html",
          "defect": [
            "https://bugzilla.suse.com/show_bug.cgi?id=1009127"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2017-7435",
    "datePublished": "2018-03-01T19:00:00Z",
    "dateReserved": "2017-04-05T00:00:00",
    "dateUpdated": "2024-09-16T22:14:57.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-7685 (GCVE-0-2018-7685)

Vulnerability from cvelistv5

Published

2018-08-31 15:00

Modified

2024-09-17 00:52

Severity ?

7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-358

Summary

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

References

►

URL

Tags

	https://bugzilla.suse.com/show_bug.cgi?id=1091624	x_refsource_CONFIRM
	https://www.suse.com/de-de/security/cve/CVE-2018-7685/	x_refsource_MISC
	http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SUSE	libzypp	Version: unspecified < 17.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:05.075Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1091624"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.suse.com/de-de/security/cve/CVE-2018-7685/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libzypp",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "17.5.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-08-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-358",
              "description": "CWE-358",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-06T16:16:08",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1091624"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.suse.com/de-de/security/cve/CVE-2018-7685/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html"
        }
      ],
      "source": {
        "defect": [
          "1091624"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "libzypp does not reevaluate malicious rpms once downloaded",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "DATE_PUBLIC": "2018-08-30T00:00:00.000Z",
          "ID": "CVE-2018-7685",
          "STATE": "PUBLIC",
          "TITLE": "libzypp does not reevaluate malicious rpms once downloaded"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libzypp",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "17.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-358"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1091624",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1091624"
            },
            {
              "name": "https://www.suse.com/de-de/security/cve/CVE-2018-7685/",
              "refsource": "MISC",
              "url": "https://www.suse.com/de-de/security/cve/CVE-2018-7685/"
            },
            {
              "name": "http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html",
              "refsource": "MISC",
              "url": "http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html"
            }
          ]
        },
        "source": {
          "defect": [
            "1091624"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2018-7685",
    "datePublished": "2018-08-31T15:00:00Z",
    "dateReserved": "2018-03-05T00:00:00",
    "dateUpdated": "2024-09-17T00:52:15.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-9269 (GCVE-0-2017-9269)

Vulnerability from cvelistv5

Published

2018-03-01 19:00

Modified

2024-09-17 00:36

Severity ?

7.7 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE

Malicious mirrors could downgrade repositories from trusted signed repositories to unsigned malicious repositories.
CWE-757

Summary

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

References

►

URL

Tags

	https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.suse.com/show_bug.cgi?id=1045735	x_refsource_CONFIRM
	https://www.suse.com/de-de/security/cve/CVE-2017-9269/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	SUSE	libzypp	Version: unspecified < 201808

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:02:43.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2017:2040",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045735"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9269/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libzypp",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "201808",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Moritz Duge and Till Doerges from PRESENSE"
        }
      ],
      "datePublic": "2017-08-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Malicious mirrors could downgrade repositories from trusted signed repositories to unsigned malicious repositories.",
              "lang": "en",
              "type": "text"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-757",
              "description": "CWE-757",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-06T16:15:46",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "name": "SUSE-SU-2017:2040",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045735"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9269/"
        }
      ],
      "source": {
        "defect": [
          "https://bugzilla.suse.com/show_bug.cgi?id=1045735"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "lack of keypinning in libzypp could lead to repository switching",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "DATE_PUBLIC": "2017-08-03T00:00:00.000Z",
          "ID": "CVE-2017-9269",
          "STATE": "PUBLIC",
          "TITLE": "lack of keypinning in libzypp could lead to repository switching"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libzypp",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "201808"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Moritz Duge and Till Doerges from PRESENSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Malicious mirrors could downgrade repositories from trusted signed repositories to unsigned malicious repositories."
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-757"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2017:2040",
              "refsource": "SUSE",
              "url": "https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1045735",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045735"
            },
            {
              "name": "https://www.suse.com/de-de/security/cve/CVE-2017-9269/",
              "refsource": "CONFIRM",
              "url": "https://www.suse.com/de-de/security/cve/CVE-2017-9269/"
            }
          ]
        },
        "source": {
          "defect": [
            "https://bugzilla.suse.com/show_bug.cgi?id=1045735"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2017-9269",
    "datePublished": "2018-03-01T19:00:00Z",
    "dateReserved": "2017-05-29T00:00:00",
    "dateUpdated": "2024-09-17T00:36:56.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-18900 (GCVE-0-2019-18900)

Vulnerability from cvelistv5

Published

2020-01-24 15:15

Modified

2024-09-16 20:52

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-276 - Incorrect Default Permissions

Summary

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

References

►

URL

Tags

	https://bugzilla.suse.com/show_bug.cgi?id=1158763	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00036.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2020/03/msg00005.html	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

►

SUSE

CaaS Platform 3.0

Version: libzypp < 16.21.2-27.68.1

	SUSE	SUSE Linux Enterprise Server 12	Version: libzypp < 16.21.2-2.45.1
	SUSE	SUSE Linux Enterprise Server 15	Version: libzypp 17.19.0-3.34.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:02:39.846Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1158763"
          },
          {
            "name": "openSUSE-SU-2020:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00036.html"
          },
          {
            "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2132-1] libzypp security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00005.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CaaS Platform 3.0",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "16.21.2-27.68.1",
              "status": "affected",
              "version": "libzypp",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "16.21.2-2.45.1",
              "status": "affected",
              "version": "libzypp",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 15",
          "vendor": "SUSE",
          "versions": [
            {
              "status": "affected",
              "version": "libzypp 17.19.0-3.34.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Matthias Gerstner of SUSE"
        }
      ],
      "datePublic": "2020-01-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": ": Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-04T04:05:59",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1158763"
        },
        {
          "name": "openSUSE-SU-2020:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00036.html"
        },
        {
          "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2132-1] libzypp security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00005.html"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1158763",
        "defect": [
          "1158763"
        ],
        "discovery": "INTERNAL"
      },
      "title": "libzypp stores cookies world readable",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2020-01-24T00:00:00.000Z",
          "ID": "CVE-2019-18900",
          "STATE": "PUBLIC",
          "TITLE": "libzypp stores cookies world readable"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CaaS Platform 3.0",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "libzypp",
                            "version_value": "16.21.2-27.68.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "libzypp",
                            "version_value": "16.21.2-2.45.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 15",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "libzypp",
                            "version_value": "17.19.0-3.34.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Matthias Gerstner of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": ": Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-276: Incorrect Default Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1158763",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1158763"
            },
            {
              "name": "openSUSE-SU-2020:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00036.html"
            },
            {
              "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2132-1] libzypp security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00005.html"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1158763",
          "defect": [
            "1158763"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2019-18900",
    "datePublished": "2020-01-24T15:15:15.806052Z",
    "dateReserved": "2019-11-12T00:00:00",
    "dateUpdated": "2024-09-16T20:52:26.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2024:11019-1

Vulnerability from csaf_opensuse

CVE-2017-9271 (GCVE-0-2017-9271)

Vulnerability from cvelistv5

CVE-2017-7435 (GCVE-0-2017-7435)

Vulnerability from cvelistv5

CVE-2018-7685 (GCVE-0-2018-7685)

Vulnerability from cvelistv5

CVE-2017-9269 (GCVE-0-2017-9269)

Vulnerability from cvelistv5

CVE-2019-18900 (GCVE-0-2019-18900)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature