In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

This update for libzypp, zypper fixes the following issues :

libzypp security fixes :

PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)

Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)

libzypp other changes/bugs fixed: Update to version 14.45.17

RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)

PackageProvider: as well support downloading SrcPackage (for bsc#1037210)

Adapt to work with GnuPG 2.1.23 (bsc#1054088)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

Prefer calling 'repo2solv' rather than 'repo2solv.sh'

libzypp-devel should not require cmake (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

Avoid zombie tar processes (bsc#1076192)

lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

zypper security fixes: Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper other changes/bugs fixed: Update to version 1.11.70

Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)

do not recommend cron (bsc#1079334)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper provides the following fixes :

libzypp security fixes :

CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)

CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)

CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes :

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

Prefer calling 'repo2solv' rather than 'repo2solv.sh'.

libzypp-devel should not require cmake. (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)

Avoid zombie tar processes. (bsc#1076192)

man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)

ansi.h: Prevent ESC sequence strings from going out of scope.
(bsc#1092413)

RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)

PackageProvider: as well support downloading SrcPackage (for bsc#1037210)

Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes :

Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes :

download: fix crash when non-package types are passed as argument (bsc#1037210)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp :

  - Adapt to work with GnuPG 2.1.23. (bsc#1054088)

  - Support signing with subkeys. (bsc#1008325)

  - Enhance sort order for media.1/products. (bsc#1054671)

zypper :

  - Also show a gpg key's subkeys. (bsc#1008325)

  - Improve signature check callback messages. (bsc#1045735)

  - Add options to tune the GPG check settings.
    (bsc#1045735)

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984, CVE-2017-7436)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The Software Update Stack was updated to receive fixes and enhancements. libzypp :

  - Adapt to work with GnuPG 2.1.23. (bsc#1054088)

  - Support signing with subkeys. (bsc#1008325)

  - Enhance sort order for media.1/products. (bsc#1054671)     zypper :

  - Also show a gpg key's subkeys. (bsc#1008325)

  - Improve signature check callback messages. (bsc#1045735)

  - Add options to tune the GPG check settings.
    (bsc#1045735)

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984, CVE-2017-7436)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

  - Fix gpg-pubkey release (creation time) computation.
    (bsc#1036659)

  - Update lsof blacklist. (bsc#1046417)

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

yast2-pkg-bindings :

  - Do not crash when the repository URL is not defined.
    (bsc#1043218)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The Software Update Stack was updated to receive fixes and enhancements. libzypp :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

  - Fix gpg-pubkey release (creation time) computation.
    (bsc#1036659)

  - Update lsof blacklist. (bsc#1046417)

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d. yast2-pkg-bindings :

  - Do not crash when the repository URL is not defined.
    (bsc#1043218)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp :

Security issues fixed :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

Bug fixes :

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

  - Adapt loop mounting of ISO images. (bsc#1038132,     bsc#1033236)

  - Fix potential crash if repository has no baseurl.
    (bsc#1043218)

zypper :

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

  - Document support for custom repository variables defined     in /etc/zypp/vars.d.

  - Emphasize that it depends on how fast PackageKit will     respond to a 'quit' request sent if PK blocks package     management.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The Software Update Stack was updated to receive fixes and enhancements. libzypp: Security issues fixed :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984) Bug fixes :

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

  - Adapt loop mounting of ISO images. (bsc#1038132,     bsc#1033236)

  - Fix potential crash if repository has no baseurl.
    (bsc#1043218) zypper :

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

  - Document support for custom repository variables defined     in /etc/zypp/vars.d.

  - Emphasize that it depends on how fast PackageKit will     respond to a 'quit' request sent if PK blocks package     management.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
117453	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2688-1)	Nessus	SuSE Local Security Checks	critical
112200	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2555-1)	Nessus	SuSE Local Security Checks	critical
102965	openSUSE Security Update : libzypp / zypper (openSUSE-2017-1009)	Nessus	SuSE Local Security Checks	high
102955	SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2017:2344-1)	Nessus	SuSE Local Security Checks	high
102944	openSUSE Security Update : libzypp (openSUSE-2017-989)	Nessus	SuSE Local Security Checks	critical
102802	SUSE SLED12 / SLES12 Security Update : libzypp (SUSE-SU-2017:2264-1)	Nessus	SuSE Local Security Checks	critical
102334	openSUSE Security Update : libzypp / zypper (openSUSE-2017-893)	Nessus	SuSE Local Security Checks	critical
102193	SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2017:2040-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-7436

high

Tenable Plugins

critical

critical

high

high

critical

critical

critical

critical