CVE-2017-7435

CVE-2017-7435 affects libzypp (before 20170803). The issue allows adding unsigned YUM repositories without user warning, creating a vector for man‑in‑the‑middle or malicious servers to inject unsigned RPMs. Connected advisories show the fix being addressed in SUSE’s libzypp/zypper security update...

CVE-2017-7436

CVE-2017-7436 concerns a flaw in libzypp prior to 20170803 where unsigned packages could be retrieved without a user warning, enabling potential MITM or malicious servers to inject RPMs. The impact described in the accompanying advisories is high (CVE-2017-7436) with risk to package integrity and...