What’s Vulnerable › Vulnerabilities

CVE-2017-9269: lack of keypinning in libzypp could lead to repository switching

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-01 · updated 2026-06-17
• Weakness: CWE-757

Description

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Affected products

• SUSE libzypp: all versions

References

• https://bugzilla.suse.com/show_bug.cgi?id=1045735
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html
• https://www.suse.com/de-de/security/cve/CVE-2017-9269/
• https://bugzilla.suse.com/show_bug.cgi?id=1045735
• https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html
• https://www.suse.com/de-de/security/cve/CVE-2017-9269/

Get alerted when CVE-2017-9269 or the next vulnerability affects your stack