Skip to main content
VulnerabilityPublished Updated

SUSE · Security update for libzypp, zypper

Affects SUSESource GCVE Database

0
Severity
Critical

Rated by Threat Radar

Data as of 26 Oct 2026, 16:19 UTC

What to do

Affected software

ProductAffectedFixed in
SUSE Product Security Team SUSEAffected
  • SUSE
  • aarch64
  • libzypp-17.38.15-160000.1.1.aarch64
  • libzypp-devel-17.38.15-160000.1.1.aarch64
  • libzypp-devel-doc-17.38.15-160000.1.1.aarch64
  • libzypp-0:17.38.15-160000.1.1.aarch64
  • libzypp-devel-0:17.38.15-160000.1.1.aarch64
  • libzypp-devel-doc-0:17.38.15-160000.1.1.aarch64
Fixed in–

AI-suggested

A security update is available that fixes the issue by enforcing strict repository signature validation when repo_gpgcheck is enabled. Users should apply the update to libzypp and zypper to ensure legacy unsigned repository cache states are invalidated and strict signature checks are enforced. No additional mitigation actions are indicated by the vendor.

Description

A security update for libzypp and zypper addresses a security issue related to the handling of legacy unsigned repository cache states. The update enforces stricter validation of repository metadata signatures when the repo_gpgcheck setting is enabled, preventing acceptance of unsigned repositories that were previously allowed under legacy exceptions. Additional non-security fixes improve configuration parsing, credential handling, and solver problem logging.

References

Community reviews

Loading reviews…