SUSE SLED15 / SLES15 Security Update : libzypp, zypper (SUSE-SU-2018:2690-1)

critical Nessus Plugin ID 120097

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

This update for libzypp, zypper, libsolv provides the following fixes :

Security fixes in libzypp :

CVE-2018-7685: PackageProvider: Validate RPMs before caching (bsc#1091624, bsc#1088705)

CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)

Changes in libzypp: Update to version 17.6.4

Automatically fetch repository signing key from gpgkey url (bsc#1088037)

lsof: use '-K i' if lsof supports it (bsc#1099847,bsc#1036304)

Check for not imported keys after multi key import from rpmdb (bsc#1096217)

Flags: make it std=c++14 ready

Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)

Show GPGME version in log

Adapt to changes in libgpgme11-11.1.0 breaking the signature verification (bsc#1100427)

RepoInfo::provideKey: add report telling where we look for missing keys.

Support listing gpgkey URLs in repo files (bsc#1088037)

Add new report to request user approval for importing a package key

Handle http error 502 Bad Gateway in curl backend (bsc#1070851)

Add filesize check for downloads with known size (bsc#408814)

Removed superfluous space in translation (bsc#1102019)

Prevent the system from sleeping during a commit

RepoManager: Explicitly request repo2solv to generate application pseudo packages.

libzypp-devel should not require cmake (bsc#1101349)

Avoid zombies from ExternalProgram

Update ApiConfig

HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803)

lsof: use '-K i' if lsof supports it (bsc#1099847)

Add filesize check for downloads with known size (bsc#408814)

Fix detection of metalink downloads and prevent aborting if a metalink file is larger than the expected data file.

Require libsolv-devel >= 0.6.35 during build (fixing bsc#1100095)

Make use of %license macro (bsc#1082318)

Security fix in zypper: CVE-2017-9269: Improve signature check callback messages (bsc#1045735)

Changes in zypper: Always set error status if any nr of unknown repositories are passed to lr and ref (bsc#1093103)

Notify user about unsupported rpm V3 keys in an old rpm database (bsc#1096217)

Detect read only filesystem on system modifying operations (fixes #199)

Use %license (bsc#1082318)

Handle repo aliases containing multiple ':' in the PackageArgs parser (bsc #1041178)

Fix broken display of detailed query results.

Fix broken search for items with a dash. (bsc#907538, bsc#1043166, bsc#1070770)

Disable repository operations when searching installed packages.
(bsc#1084525)

Prevent nested calls to exit() if aborted by a signal. (bsc#1092413)

ansi.h: Prevent ESC sequence strings from going out of scope.
(bsc#1092413)

Fix some translation errors.

Support listing gpgkey URLs in repo files (bsc#1088037)

Check for root privileges in zypper verify and si (bsc#1058515)

XML <install-summary> attribute `packages-to-change` added (bsc#1102429) </install-summary>

Add expert (allow-*) options to all installer commands (bsc#428822)

Sort search results by multiple columns (bsc#1066215)

man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)

Set error status if repositories passed to lr and ref are not known (bsc#1093103)

Do not override table style in search

Fix out of bound read in MbsIterator

Add --supplements switch to search and info

Add setter functions for zypp cache related config values to ZConfig

Changes in libsolv: convert repo2solv.sh script into a binary tool

Make use of %license macro (bsc#1082318)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Development Tools 15:zypper in -t patch SUSE-SLE-Module-Development-Tools-15-2018-1883=1

SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-1883=1

Plugin Details

Severity: Critical

ID: 120097

File Name: suse_SU-2018-2690-1.nasl

Version: 1.5

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 1/2/2019

Updated: 7/10/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-9269

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:zypper, p-cpe:/a:novell:suse_linux:libsolv-tools, p-cpe:/a:novell:suse_linux:zypper-debugsource, p-cpe:/a:novell:suse_linux:libsolv-debugsource, p-cpe:/a:novell:suse_linux:python-solv-debuginfo, p-cpe:/a:novell:suse_linux:libsolv-devel, p-cpe:/a:novell:suse_linux:python-solv, p-cpe:/a:novell:suse_linux:libzypp-debuginfo, p-cpe:/a:novell:suse_linux:libsolv-devel-debuginfo, p-cpe:/a:novell:suse_linux:ruby-solv-debuginfo, p-cpe:/a:novell:suse_linux:libzypp-devel, p-cpe:/a:novell:suse_linux:zypper-debuginfo, p-cpe:/a:novell:suse_linux:libzypp-debugsource, p-cpe:/a:novell:suse_linux:perl-solv, p-cpe:/a:novell:suse_linux:libsolv-tools-debuginfo, p-cpe:/a:novell:suse_linux:python3-solv, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libsolv-debuginfo, p-cpe:/a:novell:suse_linux:perl-solv-debuginfo, p-cpe:/a:novell:suse_linux:python3-solv-debuginfo, p-cpe:/a:novell:suse_linux:libzypp, p-cpe:/a:novell:suse_linux:ruby-solv

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/11/2018

Vulnerability Publication Date: 3/1/2018

Reference Information

CVE: CVE-2017-9269, CVE-2018-7685

Detections

Analytics