Security update for libzypp, zypper SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:2370-1 Final 1 1 2017-09-05T21:45:58Z current 2017-09-05T21:45:58Z 2017-09-05T21:45:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libzypp, zypper The Software Update Stack was updated to receive fixes and enhancements. libzypp: - Adapt to work with GnuPG 2.1.23. (bsc#1054088) - Support signing with subkeys. (bsc#1008325) - Enhance sort order for media.1/products. (bsc#1054671) zypper: - Also show a gpg key's subkeys. (bsc#1008325) - Improve signature check callback messages. (bsc#1045735) - Add options to tune the GPG check settings. (bsc#1045735) - Adapt download callback to report and handle unsigned packages. (bsc#1038984, CVE-2017-7436) - Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785) This update was imported from the SUSE:SLE-12-SP3:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2017-09/msg00014.html E-Mail link for openSUSE-SU-2017:2370-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libzypp-16.15.6-12.1 libzypp-devel-16.15.6-12.1 libzypp-devel-doc-16.15.6-12.1 zypper-1.13.32-8.1 zypper-aptitude-1.13.32-8.1 zypper-log-1.13.32-8.1 libzypp-16.15.6-12.1 as a component of openSUSE Leap 42.3 libzypp-devel-16.15.6-12.1 as a component of openSUSE Leap 42.3 libzypp-devel-doc-16.15.6-12.1 as a component of openSUSE Leap 42.3 zypper-1.13.32-8.1 as a component of openSUSE Leap 42.3 zypper-aptitude-1.13.32-8.1 as a component of openSUSE Leap 42.3 zypper-log-1.13.32-8.1 as a component of openSUSE Leap 42.3 In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system. CVE-2017-7436 openSUSE Leap 42.3:libzypp-16.15.6-12.1 openSUSE Leap 42.3:libzypp-devel-16.15.6-12.1 openSUSE Leap 42.3:libzypp-devel-doc-16.15.6-12.1 openSUSE Leap 42.3:zypper-1.13.32-8.1 openSUSE Leap 42.3:zypper-aptitude-1.13.32-8.1 openSUSE Leap 42.3:zypper-log-1.13.32-8.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-09/msg00014.html https://www.suse.com/security/cve/CVE-2017-7436.html CVE-2017-7436 https://bugzilla.suse.com/1008325 SUSE Bug 1008325 https://bugzilla.suse.com/1009127 SUSE Bug 1009127 https://bugzilla.suse.com/1038984 SUSE Bug 1038984 https://bugzilla.suse.com/1045735 SUSE Bug 1045735