CVE-2017-7435 libzypp accepts unsigned 3rd party repo without warning
Attackers can inject malicious RPM packages by adding unsigned YUM repositories without warning, bypassing security checks in libzypp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7435?
CVE-2017-7435 is a high-severity vulnerability in SUSE libzypp, published on 1 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Weakness: CWE-20
Which versions are affected by CVE-2017-7435?
It affects 1 product.
Products include Opensuse Libzypp.
How do I fix CVE-2017-7435?
Upgrade to a fixed version.
Is CVE-2017-7435 being exploited?
There is no known exploitation of CVE-2017-7435 in the wild and no public exploit code.
Other vulnerabilities in SUSE libzypp
- CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
- CVE-2026-44941 libzypp path traversal via "keyhint" in repomd.xml
- CVE-2017-7436 libzypp accepts unsigned packages even when configured to check signatures
- CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded
- CVE-2017-9269 lack of keypinning in libzypp could lead to repository switching
Sources
Also known as DEBIAN-CVE-2017-7435, GHSA-gvfg-vcp7-gmf9, UBUNTU-CVE-2017-7435.