CVE-2017-7436 — libzypp accepts unsigned packages even when configured to check signatures
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malic…
Published: 2018-03-01 · CVSS: 8.1 · CVSS 3.0
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7