SUSE-SU-2018:2555-1

CVE-2018-7685: Validate RPMs before caching (bsc#1091624, bsc#1088705)
CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)
CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check workflows, mainly for unsigned repos and packages (bsc#1045735, bsc#1038984)

libzypp changes:

RepoManager: Explicitly request repo2solv to generate application pseudo packages.
Prefer calling 'repo2solv' rather than 'repo2solv.sh'.
libzypp-devel should not require cmake. (bsc#1101349)
HardLocksFile: Prevent against empty commit without Target having been loaded. (bsc#1096803)
Avoid zombie tar processes. (bsc#1076192)
man: Make sure that '--config FILE' affects zypper.conf, not zypp.conf. (bsc#1100028)
ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)
RepoInfo: add enum GpgCheck for convenient gpgcheck mode handling (bsc#1045735)
repo refresh: Re-probe if the repository type changes (bsc#1048315)
Use common workflow for downloading packages and srcpackages. This includes a common way of handling and reporting gpg signature and checks. (bsc#1037210)
PackageProvider: as well support downloading SrcPackage (for bsc#1037210)
Adapt to work with GnuPG 2.1.23 (bsc#1054088) Use 'gpg --list-packets' to determine the keyid to verify a signature.
Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

zypper security fixes:

Improve signature check callback messages (bsc#1045735, CVE-2017-9269)
add/modify repo: Add options to tune the GPG check settings (bsc#1045735, CVE-2017-9269)
Adapt download callback to report and handle unsigned packages (bsc#1038984, CVE-2017-7436)

zypper changes:

download: fix crash when non-package types are passed as argument (bsc#1037210)
XML <install-summary> attribute packages-to-change added (bsc#1102429)

References

Affected packages

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / libzypp

Package

Name: libzypp
Purl: pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.25.17-46.22.1

Ecosystem specific

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / zypper

Package

Name: zypper
Purl: pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.59-46.10.1

Ecosystem specific

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / libzypp

Package

Name: libzypp
Purl: pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.25.17-46.22.1

Ecosystem specific

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / zypper

Package

Name: zypper
Purl: pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.59-46.10.1

Ecosystem specific

{
    "binaries": [
        {
            "zypper": "1.12.59-46.10.1",
            "libzypp": "15.25.17-46.22.1",
            "zypper-log": "1.12.59-46.10.1"
        }
    ]
}