CVE-2017-9269CWE-757

lack of keypinning in libzypp could lead to repository switching

High · published March 1, 2018

CVSS v3.0
7.7
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.

The record
Technical detail
CVSS v3.0
7.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.02247 · 82.6th percentile
Weakness
CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2018-03-01T19:00Z
EPSS history
Timeline
  • 01 MAR 19:00Z
    lack of keypinning in libzypp could lead to repository switching
    cvelistv5