Skip to content
Sign in
8.1 High

CVE-2017-7436 In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could…

Description

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Affected products and versions

Product Affected versions Fixed in
libzypp 20170803 earliest → < 20170803 20170803

Other CVEs of libzypp

The 7 CVEs of libzypp →
CVE-2026-44941 A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by… 8.4 High CVE-2026-25707 A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by… 8.8 High CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x… 6.5 Medium CVE-2018-7685 The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the… 7.8 High
Track this CVE