CVE-2013-3704
Medium
Description
The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a more-trustworthy key.
SeverityMedium
CVSS4.3
Exploit probability—
ProductNovell Libzypp
PublishedOct 28, 2013
First seenOct 28, 2013
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| novell libzypp | v ≤ 12.15.0, 11.2, 11.3, 11.4, 12.1, 12.2, 12.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.