VULNERABILITY INTELLIGENCE
CVE-2017-9269
CVSS score7.7 HIGH
EPSS probability2.25%
CISA KEVNot currently listed
Published2018-03-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Description
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Weakness classification
- CWE-20: Improper Input Validation
- CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')