In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

This update for libzypp, zypper, libsolv provides the following fixes :

Security fixes in libzypp :

  - CVE-2018-7685: PackageProvider: Validate RPMs before     caching (bsc#1091624, bsc#1088705)

  - CVE-2017-9269: Be sure bad packages do not stay in the     cache (bsc#1045735)

Changes in libzypp :

  - Update to version 17.6.4

  - Automatically fetch repository signing key from gpgkey     url (bsc#1088037)

  - lsof: use '-K i' if lsof supports it     (bsc#1099847,bsc#1036304)

  - Check for not imported keys after multi key import from     rpmdb (bsc#1096217)

  - Flags: make it std=c++14 ready

  - Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)

  - Show GPGME version in log

  - Adapt to changes in libgpgme11-11.1.0 breaking the     signature verification (bsc#1100427)

  - RepoInfo::provideKey: add report telling where we look     for missing keys.

  - Support listing gpgkey URLs in repo files (bsc#1088037)

  - Add new report to request user approval for importing a     package key

  - Handle http error 502 Bad Gateway in curl backend     (bsc#1070851)

  - Add filesize check for downloads with known size     (bsc#408814)

  - Removed superfluous space in translation (bsc#1102019)

  - Prevent the system from sleeping during a commit

  - RepoManager: Explicitly request repo2solv to generate     application pseudo packages.

  - libzypp-devel should not require cmake (bsc#1101349)

  - Avoid zombies from ExternalProgram

  - Update ApiConfig

  - HardLocksFile: Prevent against empty commit without     Target having been been loaded (bsc#1096803)

  - lsof: use '-K i' if lsof supports it (bsc#1099847)

  - Add filesize check for downloads with known size     (bsc#408814)

  - Fix detection of metalink downloads and prevent aborting     if a metalink file is larger than the expected data     file.

  - Require libsolv-devel >= 0.6.35 during build (fixing     bsc#1100095)

  - Make use of %license macro (bsc#1082318)

Security fix in zypper :

  - CVE-2017-9269: Improve signature check callback messages     (bsc#1045735)

Changes in zypper :

  - Always set error status if any nr of unknown     repositories are passed to lr and ref (bsc#1093103)

  - Notify user about unsupported rpm V3 keys in an old rpm     database (bsc#1096217)

  - Detect read only filesystem on system modifying     operations (fixes #199)

  - Use %license (bsc#1082318)

  - Handle repo aliases containing multiple ':' in the     PackageArgs parser (bsc #1041178)

  - Fix broken display of detailed query results.

  - Fix broken search for items with a dash. (bsc#907538,     bsc#1043166, bsc#1070770)

  - Disable repository operations when searching installed     packages. (bsc#1084525)

  - Prevent nested calls to exit() if aborted by a signal.
    (bsc#1092413)

  - ansi.h: Prevent ESC sequence strings from going out of     scope. (bsc#1092413)

  - Fix some translation errors.

  - Support listing gpgkey URLs in repo files (bsc#1088037)

  - Check for root privileges in zypper verify and si     (bsc#1058515)

  - XML <install-summary> attribute `packages-to-change`     added (bsc#1102429)

  - Add expert (allow-*) options to all installer commands     (bsc#428822)

  - Sort search results by multiple columns (bsc#1066215)

  - man: Strengthen that `--config FILE' affects     zypper.conf, not zypp.conf (bsc#1100028)

  - Set error status if repositories passed to lr and ref     are not known (bsc#1093103)

  - Do not override table style in search

  - Fix out of bound read in MbsIterator

  - Add --supplements switch to search and info

  - Add setter functions for zypp cache related config     values to ZConfig

Changes in libsolv :

  - convert repo2solv.sh script into a binary tool

  - Make use of %license macro (bsc#1082318)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libzypp, zypper, libsolv provides the following fixes :

Security fixes in libzypp :

CVE-2018-7685: PackageProvider: Validate RPMs before caching (bsc#1091624, bsc#1088705)

CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)

Changes in libzypp: Update to version 17.6.4

Automatically fetch repository signing key from gpgkey url (bsc#1088037)

lsof: use '-K i' if lsof supports it (bsc#1099847,bsc#1036304)

Check for not imported keys after multi key import from rpmdb (bsc#1096217)

Flags: make it std=c++14 ready

Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)

Show GPGME version in log

Adapt to changes in libgpgme11-11.1.0 breaking the signature verification (bsc#1100427)

RepoInfo::provideKey: add report telling where we look for missing keys.

Support listing gpgkey URLs in repo files (bsc#1088037)

Add new report to request user approval for importing a package key

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

Add filesize check for downloads with known size (bsc#408814)

Removed superfluous space in translation (bsc#1102019)

Prevent the system from sleeping during a commit

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

libzypp-devel should not require cmake (bsc#1101349)

Avoid zombies from ExternalProgram

Update ApiConfig

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

lsof: use '-K i' if lsof supports it (bsc#1099847)

Add filesize check for downloads with known size (bsc#408814)

Fix detection of metalink downloads and prevent aborting if a metalink file is larger than the expected data file.

Require libsolv-devel >= 0.6.35 during build (fixing bsc#1100095)

Make use of %license macro (bsc#1082318)

Security fix in zypper: CVE-2017-9269: Improve signature check callback messages (bsc#1045735)

Changes in zypper: Always set error status if any nr of unknown repositories are passed to lr and ref (bsc#1093103)

Notify user about unsupported rpm V3 keys in an old rpm database (bsc#1096217)

Detect read only filesystem on system modifying operations (fixes #199)

Use %license (bsc#1082318)

Handle repo aliases containing multiple ':' in the PackageArgs parser (bsc #1041178)

Fix broken display of detailed query results.

Fix broken search for items with a dash. (bsc#907538, bsc#1043166, bsc#1070770)

Disable repository operations when searching installed packages.
(bsc#1084525)

Prevent nested calls to exit() if aborted by a signal. (bsc#1092413)

ansi.h: Prevent ESC sequence strings from going out of scope.
(bsc#1092413)

Fix some translation errors.

Support listing gpgkey URLs in repo files (bsc#1088037)

Check for root privileges in zypper verify and si (bsc#1058515)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

Add expert (allow-*) options to all installer commands (bsc#428822)

Sort search results by multiple columns (bsc#1066215)

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

Set error status if repositories passed to lr and ref are not known (bsc#1093103)

Do not override table style in search

Fix out of bound read in MbsIterator

Add --supplements switch to search and info

Add setter functions for zypp cache related config values to ZConfig

Changes in libsolv: convert repo2solv.sh script into a binary tool

Make use of %license macro (bsc#1082318)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper provides the following fixes :

Update libzypp to version 16.17.20

Security issues fixed :

PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed: lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

libzypp-devel should not require cmake (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45

Security issue fixed: Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Other bugs fixed: XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

Prevent nested calls to exit() if aborted by a signal (bsc#1092413)

ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)

Fix: zypper bash completion expands non-existing options (bsc#1049825)

do not recommend cron (bsc#1079334)

Improve signature check callback messages (bsc#1045735)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper fixes the following issues :

Update libzypp to version 16.17.20 :

Security issues fixed :

PackageProvider: Validate deta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed: lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

libzypp-devel should not require cmake (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45 :

Security issues fixed: Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Other bugs fixed: XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

Prevent nested calls to exit() if aborted by a signal (bsc#1092413)

ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)

Fix: zypper bash completion expands non-existing options (bsc#1049825)

Improve signature check callback messages (bsc#1045735)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper fixes the following issues :

libzypp security fixes :

PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Be sure bad packages do not stay in the cache (bsc#1045735, CVE-2017-9269)

Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984, CVE-2017-7435, CVE-2017-7436, CVE-2017-9269)

libzypp other changes/bugs fixed: Update to version 14.45.17

RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)

PackageProvider: as well support downloading SrcPackage (for bsc#1037210)

Adapt to work with GnuPG 2.1.23 (bsc#1054088)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

Prefer calling 'repo2solv' rather than 'repo2solv.sh'

libzypp-devel should not require cmake (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

Avoid zombie tar processes (bsc#1076192)

lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)

zypper security fixes: Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper other changes/bugs fixed: Update to version 1.11.70

Bugfix: Prevent ESC sequence strings from going out of scope (bsc#1092413)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413)

do not recommend cron (bsc#1079334)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper provides the following fixes :

libzypp security fixes :

CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)

CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)

CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes :

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

Prefer calling 'repo2solv' rather than 'repo2solv.sh'.

libzypp-devel should not require cmake. (bsc#1101349)

HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)

Avoid zombie tar processes. (bsc#1076192)

man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)

ansi.h: Prevent ESC sequence strings from going out of scope.
(bsc#1092413)

RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)

repo refresh: Re-probe if the repository type changes (bsc#1048315)

Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)

PackageProvider: as well support downloading SrcPackage (for bsc#1037210)

Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes :

Improve signature check callback messages (bsc#1045735, CVE-2017-9269)

add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)

Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes :

download: fix crash when non-package types are passed as argument (bsc#1037210)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

  - Fix gpg-pubkey release (creation time) computation.
    (bsc#1036659)

  - Update lsof blacklist. (bsc#1046417)

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

yast2-pkg-bindings :

  - Do not crash when the repository URL is not defined.
    (bsc#1043218)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The Software Update Stack was updated to receive fixes and enhancements. libzypp :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

  - Fix gpg-pubkey release (creation time) computation.
    (bsc#1036659)

  - Update lsof blacklist. (bsc#1046417)

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d. yast2-pkg-bindings :

  - Do not crash when the repository URL is not defined.
    (bsc#1043218)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Software Update Stack was updated to receive fixes and enhancements.

libzypp :

Security issues fixed :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984)

Bug fixes :

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

  - Adapt loop mounting of ISO images. (bsc#1038132,     bsc#1033236)

  - Fix potential crash if repository has no baseurl.
    (bsc#1043218)

zypper :

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

  - Document support for custom repository variables defined     in /etc/zypp/vars.d.

  - Emphasize that it depends on how fast PackageKit will     respond to a 'quit' request sent if PK blocks package     management.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The Software Update Stack was updated to receive fixes and enhancements. libzypp: Security issues fixed :

  - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG     check workflows, mainly for unsigned repositories and     packages. (bsc#1045735, bsc#1038984) Bug fixes :

  - Re-probe on refresh if the repository type changes.
    (bsc#1048315)

  - Propagate proper error code to DownloadProgressReport.
    (bsc#1047785)

  - Allow to trigger an appdata refresh unconditionally.
    (bsc#1009745)

  - Support custom repo variables defined in     /etc/zypp/vars.d.

  - Adapt loop mounting of ISO images. (bsc#1038132,     bsc#1033236)

  - Fix potential crash if repository has no baseurl.
    (bsc#1043218) zypper :

  - Adapt download callback to report and handle unsigned     packages. (bsc#1038984)

  - Report missing/optional files as 'not found' rather than     'error'. (bsc#1047785)

  - Document support for custom repository variables defined     in /etc/zypp/vars.d.

  - Emphasize that it depends on how fast PackageKit will     respond to a 'quit' request sent if PK blocks package     management.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
123296	openSUSE Security Update : libzypp / zypper (openSUSE-2019-685)	Nessus	SuSE Local Security Checks	critical
120097	SUSE SLED15 / SLES15 Security Update : libzypp, zypper (SUSE-SU-2018:2690-1)	Nessus	SuSE Local Security Checks	critical
118289	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2716-2)	Nessus	SuSE Local Security Checks	critical
117694	SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2814-1)	Nessus	SuSE Local Security Checks	critical
117528	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2716-1)	Nessus	SuSE Local Security Checks	critical
117524	openSUSE Security Update : libzypp / zypper (openSUSE-2018-1017)	Nessus	SuSE Local Security Checks	critical
117453	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2688-1)	Nessus	SuSE Local Security Checks	critical
112200	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2555-1)	Nessus	SuSE Local Security Checks	critical
102944	openSUSE Security Update : libzypp (openSUSE-2017-989)	Nessus	SuSE Local Security Checks	critical
102802	SUSE SLED12 / SLES12 Security Update : libzypp (SUSE-SU-2017:2264-1)	Nessus	SuSE Local Security Checks	critical
102334	openSUSE Security Update : libzypp / zypper (openSUSE-2017-893)	Nessus	SuSE Local Security Checks	critical
102193	SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2017:2040-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-9269

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical