CVE-2017-9269 Vulnerability Details

  /     /     /  

CVE-2017-9269 Metadata Quick Info

CVE Published: 01/03/2018 | CVE Updated: 17/09/2024 | CVE Year: 2017
Source: microfocus | Vendor: SUSE | Product: libzypp
Status : PUBLISHED

---

CVE-2017-9269 Description

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Malicious mirrors could downgrade repositories from trusted signed repositories to unsigned malicious repositories.
Source: SUSE

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).