The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libzypp | Jul 30, 2024 | Mar 1, 2018 |
| Suse | — | Upgrade yast2-installationUpgrade python-solvUpgrade libyui-ncurses-pkg-docUpgrade libsolv-toolsUpgrade perl-solvUpgrade zypper-needs-restartingUpgrade zypperUpgrade libzypp-devel-docUpgrade libsigc-2_0-0Upgrade libsigc++2-develUpgrade libyui-qt-pkg-docUpgrade libzypp-develUpgrade yast2-pkg-bindingsUpgrade ruby-solvUpgrade libyui-qt-pkg-develUpgrade zypper-aptitudeUpgrade libyui-qt-pkg9Upgrade libzyppUpgrade zypper-logUpgrade python3-solvUpgrade libyui-ncurses-pkg-develUpgrade libyui-ncurses-pkg9Upgrade libsolv-devel | Jan 16, 2021 | Mar 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub