CVE catalog

CVE-2019-18900

libzypp: CVE-2019-18900

[CVE catalog]

Severity
Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibzyppsid17.38.16-1fixed
Debianlibzyppforky17.38.16-1fixed
Debianlibzypptrixie17.36.7-1fixed
Debianlibzyppbookworm17.25.7-2.4fixed
Suselibsolvlinux enterprise module for basesystem 150.7.10-3.22.1fixed
Suselibzypplinux enterprise module for basesystem 1517.19.0-3.34.1fixed
Susezypperlinux enterprise module for basesystem 151.14.33-3.29.1fixed
Suselibsolvlinux enterprise module for development tools 150.7.10-3.22.1fixed
Suselibzypplinux enterprise desktop 12 sp416.21.2-2.45.1fixed
Suselibzypplinux enterprise software development kit 12 sp416.21.2-2.45.1fixed
Suselibzypplinux enterprise software development kit 12 sp516.21.2-2.45.1fixed
Suselibzypplinux enterprise server 12 sp416.21.2-2.45.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp416.21.2-2.45.1fixed
Suselibzypplinux enterprise server 12 sp516.21.2-2.45.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp516.21.2-2.45.1fixed
Opensuselibsolvleap 15.10.7.10-lp151.2.10.1fixed
Opensuselibzyppleap 15.117.19.0-lp151.2.10.1fixed
Opensusezypperleap 15.11.14.33-lp151.2.10.1fixed
Suselibzyppopenstack cloud 716.21.2-27.70.1fixed
Susezypperopenstack cloud 71.13.57-18.46.3fixed
Suselibzypplinux enterprise server for sap applications 12 sp216.21.2-27.70.1fixed
Susezypperlinux enterprise server for sap applications 12 sp21.13.57-18.46.3fixed
Suselibzypplinux enterprise server 12 sp2-ltss16.21.2-27.70.1fixed
Susezypperlinux enterprise server 12 sp2-ltss1.13.57-18.46.3fixed
Suselibzypplinux enterprise server 12 sp2-bcl16.21.2-27.70.1fixed
Susezypperlinux enterprise server 12 sp2-bcl1.13.57-18.46.3fixed
Suselibsolvlinux enterprise module for basesystem 15 sp10.7.10-3.13.4fixed
Suselibzypplinux enterprise module for basesystem 15 sp117.19.0-3.14.5fixed
Susezypperlinux enterprise module for basesystem 15 sp11.14.33-3.13.5fixed
Suselibsolvlinux enterprise module for development tools 15 sp10.7.10-3.13.4fixed
Suselibsolvlinux enterprise module for package hub 15 sp10.7.10-3.13.4fixed
Suselibzypphpe helion openstack 816.21.2-2.45.1fixed
Suselibzyppopenstack cloud 816.21.2-2.45.1fixed
Suselibzyppopenstack cloud 916.21.2-2.45.1fixed
Suselibzyppopenstack cloud crowbar 816.21.2-2.45.1fixed
Suselibzyppopenstack cloud crowbar 916.21.2-2.45.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp316.21.2-2.45.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp416.21.2-2.45.1fixed
Suselibzypplinux enterprise server 12 sp3-ltss16.21.2-2.45.1fixed
Suselibzypplinux enterprise server 12 sp3-bcl16.21.2-2.45.1fixed
Suselibzypplinux enterprise server 12 sp4-ltss16.21.2-2.45.1fixed
Suselibzyppenterprise storage 516.21.2-2.45.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibzyppsourcesid17.25.5-2not yet assignedNot reported[953362]
Debianlibzyppsourceforky17.25.5-2not yet assignedNot reported[953362]
Debianlibzyppsourcetrixie17.25.5-2not yet assignedNot reported[953362]
Debianlibzyppsourcebookworm17.25.5-2not yet assignedNot reported[953362]
Suselibsolvrpmlinux enterprise module for basesystem 150.7.10-3.22.1Not reportedSUSE-SU-2020:0087-1Not reported
Suselibzypprpmlinux enterprise module for basesystem 1517.19.0-3.34.1Not reportedSUSE-SU-2020:0087-1Not reported
Susezypperrpmlinux enterprise module for basesystem 151.14.33-3.29.1Not reportedSUSE-SU-2020:0087-1Not reported
Suselibsolvrpmlinux enterprise module for development tools 150.7.10-3.22.1Not reportedSUSE-SU-2020:0087-1Not reported
Suselibzypprpmlinux enterprise desktop 12 sp416.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise software development kit 12 sp416.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise software development kit 12 sp516.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise server 12 sp416.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp416.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise server 12 sp516.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp516.21.2-2.45.1Not reportedSUSE-SU-2020:0079-1Not reported
Opensuselibsolvrpmleap 15.10.7.10-lp151.2.10.1Not reportedOPENSUSE-SU-2020:0255-1Not reported
Opensuselibzypprpmleap 15.117.19.0-lp151.2.10.1Not reportedOPENSUSE-SU-2020:0255-1Not reported
Opensusezypperrpmleap 15.11.14.33-lp151.2.10.1Not reportedOPENSUSE-SU-2020:0255-1Not reported
Suselibzypprpmopenstack cloud 716.21.2-27.70.1Not reportedSUSE-SU-2020:3367-1Not reported
Susezypperrpmopenstack cloud 71.13.57-18.46.3Not reportedSUSE-SU-2020:3367-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp216.21.2-27.70.1Not reportedSUSE-SU-2020:3367-1Not reported
Susezypperrpmlinux enterprise server for sap applications 12 sp21.13.57-18.46.3Not reportedSUSE-SU-2020:3367-1Not reported
Suselibzypprpmlinux enterprise server 12 sp2-ltss16.21.2-27.70.1Not reportedSUSE-SU-2020:3367-1Not reported
Susezypperrpmlinux enterprise server 12 sp2-ltss1.13.57-18.46.3Not reportedSUSE-SU-2020:3367-1Not reported
Suselibzypprpmlinux enterprise server 12 sp2-bcl16.21.2-27.70.1Not reportedSUSE-SU-2020:3367-1Not reported
Susezypperrpmlinux enterprise server 12 sp2-bcl1.13.57-18.46.3Not reportedSUSE-SU-2020:3367-1Not reported
Suselibsolvrpmlinux enterprise module for basesystem 15 sp10.7.10-3.13.4Not reportedSUSE-SU-2020:0432-1Not reported
Suselibzypprpmlinux enterprise module for basesystem 15 sp117.19.0-3.14.5Not reportedSUSE-SU-2020:0432-1Not reported
Susezypperrpmlinux enterprise module for basesystem 15 sp11.14.33-3.13.5Not reportedSUSE-SU-2020:0432-1Not reported
Suselibsolvrpmlinux enterprise module for development tools 15 sp10.7.10-3.13.4Not reportedSUSE-SU-2020:0432-1Not reported
Suselibsolvrpmlinux enterprise module for package hub 15 sp10.7.10-3.13.4Not reportedSUSE-SU-2020:0432-1Not reported
Suselibzypprpmhpe helion openstack 816.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmopenstack cloud 816.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmopenstack cloud 916.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmopenstack cloud crowbar 816.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmopenstack cloud crowbar 916.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp316.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp416.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmlinux enterprise server 12 sp3-ltss16.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmlinux enterprise server 12 sp3-bcl16.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmlinux enterprise server 12 sp4-ltss16.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported
Suselibzypprpmenterprise storage 516.21.2-2.45.1Not reportedSUSE-SU-2020:0079-2Not reported

[Debian bug #953362]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzypp1722]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

[Debian 13 (Trixie)]

  • [libzypp1735]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.25.5-2

      dsa · libzypp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]