VULNERABILITY INTELLIGENCE
CVE-2018-7685
CVSS score7.8 HIGH
EPSS probability0.30%
CISA KEVNot currently listed
Published2018-08-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
Weakness classification
- CWE-347: Improper Verification of Cryptographic Signature
- CWE-358: Improperly Implemented Security Check for Standard