CVE-2017-9269 – lack of keypinning in libzypp could lead to repository switching

https://notcve.org/view.php?id=CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content. En libzypp, en versiones anteriores a agosto de 2018, las claves GPG adjuntadas en repositorios YUM no se anclaban correctamente, lo que permitía que mirrors de repositorio maliciosos degradasen silenciosamente a repositorios no firmados con contenido potencialmente malicioso. • https://bugzilla.suse.com/show_bug.cgi?id=1045735 https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html https://www.suse.com/de-de/security/cve/CVE-2017-9269 • CWE-20: Improper Input Validation CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') •