SUSE-SU-2018:2555-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2018/suse-su-20182555-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:2555-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2018:2555-1
Related
Published
2018-08-30T06:44:57Z
Modified
2018-08-30T06:44:57Z
Summary
Security update for libzypp, zypper
Details

This update for libzypp, zypper provides the following fixes:

libzypp security fixes:

  • CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)
  • CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)
  • CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes:

  • RepoManager: Explicitly request repo2solv to generate application pseudo packages.
  • Prefer calling 'repo2solv' rather than 'repo2solv.sh'.
  • libzypp-devel should not require cmake. (bsc#1101349)
  • HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)
  • Avoid zombie tar processes. (bsc#1076192)
  • man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)
  • ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)
  • RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
  • repo refresh: Re-probe if the repository type changes (bsc#1048315)
  • Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
  • PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
  • Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.
  • Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes:

  • Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
  • add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
  • Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes:

  • download: fix crash when non-package types are passed as argument (bsc#1037210)
  • XML <install-summary> attribute packages-to-change added (bsc#1102429)
References

Affected packages

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / libzypp

Package

Name
libzypp
Purl
pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
15.25.17-46.22.1

Ecosystem specific 

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / zypper

Package

Name
zypper
Purl
pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.12.59-46.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / libzypp

Package

Name
libzypp
Purl
pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
15.25.17-46.22.1

Ecosystem specific 

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / zypper

Package

Name
zypper
Purl
pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.12.59-46.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}