CVE-2017-7436 libzypp accepts unsigned packages even when configured to check signatures
Attackers can inject malicious RPM packages by bypassing signature checks in libzypp, leading to potential code execution on SUSE systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7436?
CVE-2017-7436 is a high-severity vulnerability in SUSE libzypp, published on 1 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Weakness: CWE-20
Which versions are affected by CVE-2017-7436?
It affects 1 product.
Linux distribution packages (7)
libzypp SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 16.15.6-2.8.1 |
zypper SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.13.32-21.3.2 |
libzypp SUSE:Linux Enterprise Server 12 SP3 | All versions | 16.15.6-2.8.1 |
zypper SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.13.32-21.3.2 |
libzypp SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 16.15.6-2.8.1 |
zypper SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.13.32-21.3.2 |
libzypp SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 16.15.6-2.8.1 |
Products include Opensuse Libzypp.
How do I fix CVE-2017-7436?
Apply the vendor's patch.
Is CVE-2017-7436 being exploited?
There is no known exploitation of CVE-2017-7436 in the wild and no public exploit code.
Other vulnerabilities in SUSE libzypp
- CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
- CVE-2026-44941 libzypp path traversal via "keyhint" in repomd.xml
- CVE-2017-7435 libzypp accepts unsigned 3rd party repo without warning
- CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded
- CVE-2017-9269 lack of keypinning in libzypp could lead to repository switching
Sources
Also known as DEBIAN-CVE-2017-7436, GHSA-wf75-8v2m-5h2m, SUSE-SU-2017:2344-1, UBUNTU-CVE-2017-7436.