CVE-2017-9269
9.8
CRITICAL
CVSS 3.1
EPSS 0.64%
Description
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
How to fix CVE-2017-9269
To remediate CVE-2017-9269, upgrade the affected package to a fixed version below.
- Debian/libzypp—upgrade to 17.3.1-1 or later
Is CVE-2017-9269 being exploited?
Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 17.3.1-1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |