CVE catalog

CVE-2017-9269

libzypp: CVE-2017-9269

[CVE catalog]

Severity
High · CVSS 7.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.25% · Oct 25, 2026

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibzyppsid17.38.16-1fixed
Debianlibzyppforky17.38.16-1fixed
Debianlibzypptrixie17.36.7-1fixed
Debianlibzyppbookworm17.25.7-2.4fixed
Ubuntulibzypp16.0415.3.0-1build1vulnerable
Suselibsolvlinux enterprise module for basesystem 150.6.35-3.5.2fixed
Suselibzypplinux enterprise module for basesystem 1517.6.4-3.10.1fixed
Susezypperlinux enterprise module for basesystem 151.14.10-3.7.1fixed
Suselibsolvlinux enterprise module for development tools 150.6.35-3.5.2fixed
Suselibzyppopenstack cloud 716.17.20-27.52.1fixed
Susezypperopenstack cloud 71.13.45-18.33.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp216.17.20-27.52.1fixed
Susezypperlinux enterprise server for sap applications 12 sp21.13.45-18.33.1fixed
Suselibzypplinux enterprise server 12 sp2-ltss16.17.20-27.52.1fixed
Susezypperlinux enterprise server 12 sp2-ltss1.13.45-18.33.1fixed
Suselibzyppenterprise storage 416.17.20-27.52.1fixed
Susezypperenterprise storage 41.13.45-18.33.1fixed
Suselibzypplinux enterprise server 12 sp2-bcl16.17.20-27.52.1fixed
Susezypperlinux enterprise server 12 sp2-bcl1.13.45-18.33.1fixed
Suselibzypplinux enterprise desktop 12 sp316.17.20-2.33.2fixed
Susezypperlinux enterprise desktop 12 sp31.13.45-21.21.2fixed
Suselibzypplinux enterprise software development kit 12 sp316.17.20-2.33.2fixed
Suselibzypplinux enterprise server 12 sp316.17.20-2.33.2fixed
Susezypperlinux enterprise server 12 sp31.13.45-21.21.2fixed
Suselibzypplinux enterprise server for sap applications 12 sp316.17.20-2.33.2fixed
Susezypperlinux enterprise server for sap applications 12 sp31.13.45-21.21.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibzyppsourcesid17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourceforky17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourcetrixie17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourcebookworm17.3.1-1not yet assignedNot reported[899065]
Suselibsolvrpmlinux enterprise module for basesystem 150.6.35-3.5.2Not reportedSUSE-SU-2018:2690-1Not reported
Suselibzypprpmlinux enterprise module for basesystem 1517.6.4-3.10.1Not reportedSUSE-SU-2018:2690-1Not reported
Susezypperrpmlinux enterprise module for basesystem 151.14.10-3.7.1Not reportedSUSE-SU-2018:2690-1Not reported
Suselibsolvrpmlinux enterprise module for development tools 150.6.35-3.5.2Not reportedSUSE-SU-2018:2690-1Not reported
Suselibzypprpmopenstack cloud 716.17.20-27.52.1Not reportedSUSE-SU-2018:2716-1Not reported
Susezypperrpmopenstack cloud 71.13.45-18.33.1Not reportedSUSE-SU-2018:2716-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp216.17.20-27.52.1Not reportedSUSE-SU-2018:2716-1Not reported
Susezypperrpmlinux enterprise server for sap applications 12 sp21.13.45-18.33.1Not reportedSUSE-SU-2018:2716-1Not reported
Suselibzypprpmlinux enterprise server 12 sp2-ltss16.17.20-27.52.1Not reportedSUSE-SU-2018:2716-1Not reported
Susezypperrpmlinux enterprise server 12 sp2-ltss1.13.45-18.33.1Not reportedSUSE-SU-2018:2716-1Not reported
Suselibzypprpmenterprise storage 416.17.20-27.52.1Not reportedSUSE-SU-2018:2716-1Not reported
Susezypperrpmenterprise storage 41.13.45-18.33.1Not reportedSUSE-SU-2018:2716-1Not reported
Suselibzypprpmlinux enterprise server 12 sp2-bcl16.17.20-27.52.1Not reportedSUSE-SU-2018:2716-2Not reported
Susezypperrpmlinux enterprise server 12 sp2-bcl1.13.45-18.33.1Not reportedSUSE-SU-2018:2716-2Not reported
Suselibzypprpmlinux enterprise desktop 12 sp316.17.20-2.33.2Not reportedSUSE-SU-2018:2814-1Not reported
Susezypperrpmlinux enterprise desktop 12 sp31.13.45-21.21.2Not reportedSUSE-SU-2018:2814-1Not reported
Suselibzypprpmlinux enterprise software development kit 12 sp316.17.20-2.33.2Not reportedSUSE-SU-2018:2814-1Not reported
Suselibzypprpmlinux enterprise server 12 sp316.17.20-2.33.2Not reportedSUSE-SU-2018:2814-1Not reported
Susezypperrpmlinux enterprise server 12 sp31.13.45-21.21.2Not reportedSUSE-SU-2018:2814-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp316.17.20-2.33.2Not reportedSUSE-SU-2018:2814-1Not reported
Susezypperrpmlinux enterprise server for sap applications 12 sp31.13.45-21.21.2Not reportedSUSE-SU-2018:2814-1Not reported

[Debian bug #899065]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzypp1722]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

[Debian 13 (Trixie)]

  • [libzypp1735]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]