CVE-2017-9269 lack of keypinning in libzypp could lead to repository switching
Attackers can bypass GPG key pinning in libzypp to force repository downgrades, enabling the installation of malicious unsigned packages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9269?
CVE-2017-9269 is a high-severity vulnerability in SUSE libzypp, published on 1 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Which versions are affected by CVE-2017-9269?
It affects 1 product.
Products include Opensuse Libzypp.
How do I fix CVE-2017-9269?
Upgrade to a fixed version.
Is CVE-2017-9269 being exploited?
There is no known exploitation of CVE-2017-9269 in the wild and no public exploit code.
Other vulnerabilities in SUSE libzypp
- CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
- CVE-2026-44941 libzypp path traversal via "keyhint" in repomd.xml
- CVE-2017-7435 libzypp accepts unsigned 3rd party repo without warning
- CVE-2017-7436 libzypp accepts unsigned packages even when configured to check signatures
- CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded
Sources
Also known as DEBIAN-CVE-2017-9269, GHSA-fvp9-wx3h-666q, UBUNTU-CVE-2017-9269.