CVE-2017-9271: fedoraproject fedora

CVSS: 4.0v3.0MediumModified

AliasesSUSE-SU-2021:0109-1SUSE-SU-2021:0770-1SUSE-SU-2021:0956-1+4 more

Published 01-03-2018Last modified 16-09-2024

Vulnerability summary

CVE-2017-9271 is a medium (CVSS 4.0) vulnerability in fedoraproject fedora. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.

Overall risk

16/100

0100

Low · default modelHow is this calculated?

CVSS score

4.0/10

010

Medium · v3.0 (CVE.org)

EPSS score

0.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:11019-1

Timeline

01-03-2018
PublishedVulnerability first disclosed.
16-09-2024
Last modifiedVulnerability information updated.

Description

The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.

CVSS metrics

7 scores · 4 sources · 3 versions

v3.13.3v3.04.0v2.02.1

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.

Affected systems

Suse118 products

libsigc++2&distro=SUSE Enterprise Storage 6< 2.10.0-3.7.1
libsigc++2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.10.0-3.7.1
libsigc++2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.10.0-3.7.1
libsigc++2&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 2.10.0-3.7.1
libsigc++2&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 2.10.0-3.7.1

libsigc++2&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 2.10.0-3.7.1
libsigc++2&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 2.10.0-3.7.1
libsigc++2&distro=SUSE Manager Proxy 4.0< 2.10.0-3.7.1
libsigc++2&distro=SUSE Manager Retail Branch Server 4.0< 2.10.0-3.7.1
libsigc++2&distro=SUSE Manager Server 4.0< 2.10.0-3.7.1
libsolv&distro=SUSE Enterprise Storage 6< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 0.7.17-3.40.1
libsolv&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 0.7.17-3.40.1
libsolv&distro=SUSE Linux Enterprise Installer Updates 15< 0.7.17-3.40.1
libsolv&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 0.7.17-3.32.1
libsolv&distro=SUSE Linux Enterprise Server 15-LTSS< 0.7.17-3.40.1
libsolv&distro=SUSE Linux Enterprise Server for SAP Applications 15< 0.7.17-3.40.1
libsolv&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 0.7.17-3.32.1
libsolv&distro=SUSE Manager Proxy 4.0< 0.7.17-3.32.1
libsolv&distro=SUSE Manager Retail Branch Server 4.0< 0.7.17-3.32.1
libsolv&distro=SUSE Manager Server 4.0< 0.7.17-3.32.1
libyui-ncurses-pkg-doc&distro=SUSE Enterprise Storage 6< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Manager Proxy 4.0< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Manager Retail Branch Server 4.0< 2.48.9-7.7.1
libyui-ncurses-pkg-doc&distro=SUSE Manager Server 4.0< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Enterprise Storage 6< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Manager Proxy 4.0< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Manager Retail Branch Server 4.0< 2.48.9-7.7.1
libyui-ncurses-pkg&distro=SUSE Manager Server 4.0< 2.48.9-7.7.1
libyui-qt-pkg-doc&distro=SUSE Enterprise Storage 6< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Manager Proxy 4.0< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Manager Retail Branch Server 4.0< 2.45.28-3.10.1
libyui-qt-pkg-doc&distro=SUSE Manager Server 4.0< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Enterprise Storage 6< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Manager Proxy 4.0< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Manager Retail Branch Server 4.0< 2.45.28-3.10.1
libyui-qt-pkg&distro=SUSE Manager Server 4.0< 2.45.28-3.10.1
libzypp&distro=SUSE Enterprise Storage 6< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 17.25.8-3.66.1
libzypp&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 17.25.8-3.66.1
libzypp&distro=SUSE Linux Enterprise Installer Updates 15< 17.25.8-3.66.1
libzypp&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise Installer Updates 15 SP2< 17.25.5-3.25.6
libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 17.25.5-3.25.6
libzypp&distro=SUSE Linux Enterprise Server 12 SP5< 16.22.13-65.3
libzypp&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise Server 15-LTSS< 17.25.8-3.66.1
libzypp&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 16.22.13-65.3
libzypp&distro=SUSE Linux Enterprise Server for SAP Applications 15< 17.25.8-3.66.1
libzypp&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 17.25.8-3.48.1
libzypp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 16.22.13-65.3
libzypp&distro=SUSE Manager Proxy 4.0< 17.25.8-3.48.1
libzypp&distro=SUSE Manager Retail Branch Server 4.0< 17.25.8-3.48.1
libzypp&distro=SUSE Manager Server 4.0< 17.25.8-3.48.1
yast2-installation&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 4.0.77-3.22.5
yast2-installation&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 4.0.77-3.22.5
yast2-installation&distro=SUSE Linux Enterprise Installer Updates 15< 4.0.77-3.22.5
yast2-installation&distro=SUSE Linux Enterprise Installer Updates 15 SP2< 4.2.48-3.16.1
yast2-installation&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 4.2.48-3.16.1
yast2-installation&distro=SUSE Linux Enterprise Server 15-LTSS< 4.0.77-3.22.5
yast2-installation&distro=SUSE Linux Enterprise Server for SAP Applications 15< 4.0.77-3.22.5
yast2-pkg-bindings&distro=SUSE Enterprise Storage 6< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise Installer Updates 15 SP1< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Manager Proxy 4.0< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Manager Retail Branch Server 4.0< 4.1.3-3.10.3
yast2-pkg-bindings&distro=SUSE Manager Server 4.0< 4.1.3-3.10.3
zypper&distro=SUSE Enterprise Storage 6< 1.14.43-3.34.1
zypper&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.14.43-3.34.1
zypper&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.14.43-3.34.1
zypper&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.14.43-3.49.1
zypper&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.14.43-3.49.1
zypper&distro=SUSE Linux Enterprise Installer Updates 15< 1.14.43-3.49.1
zypper&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.14.41-3.14.10
zypper&distro=SUSE Linux Enterprise Server 12 SP5< 1.13.66-21.61.3
zypper&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 1.14.43-3.34.1
zypper&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 1.14.43-3.34.1
zypper&distro=SUSE Linux Enterprise Server 15-LTSS< 1.14.43-3.49.1
zypper&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.13.66-21.61.3
zypper&distro=SUSE Linux Enterprise Server for SAP Applications 15< 1.14.43-3.49.1
zypper&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 1.14.43-3.34.1
zypper&distro=SUSE Manager Proxy 4.0< 1.14.43-3.34.1
zypper&distro=SUSE Manager Retail Branch Server 4.0< 1.14.43-3.34.1
zypper&distro=SUSE Manager Server 4.0< 1.14.43-3.34.1
zyppern/a

Show all 118

Opensuse4 products

zypperna
libzypp&distro=openSUSE Leap 15.2< 17.25.5-lp152.2.16.1
yast2-installation&distro=openSUSE Leap 15.2< 4.2.48-lp152.2.12.1
zypper&distro=openSUSE Leap 15.2< 1.14.41-lp152.2.12.1

Debian1 product

libzypp< 17.25.5-2

Fedoraproject1 product

fedoraEOL33

Ubuntu1 product

zypperAll versions (No fix recorded)

5 vendors · 125 products

References

33 links

www.suse.com/de-de/security/cve/CVE-2017-9271/X Refsource CONFIRM
bugzilla.suse.com/show_bug.cgi?id=1050625X Refsource CONFIRMREPORT
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.suse.com/support/update/announcement/2021/suse-su-20210109-1/Advisory
bugzilla.suse.com/1050625REPORT
bugzilla.suse.com/1174016REPORT
bugzilla.suse.com/1177238REPORT
bugzilla.suse.com/1177275REPORT
bugzilla.suse.com/1177427REPORT
bugzilla.suse.com/1177583REPORT

Show all 33 references

bugzilla.suse.com/1178910REPORT
bugzilla.suse.com/1178966REPORT
bugzilla.suse.com/1179083REPORT
bugzilla.suse.com/1179222REPORT
bugzilla.suse.com/1179415REPORT
bugzilla.suse.com/1179909REPORT
www.suse.com/security/cve/CVE-2017-9271WEB
www.suse.com/support/update/announcement/2021/suse-su-20210770-1/Advisory
bugzilla.suse.com/1179847REPORT
bugzilla.suse.com/1181328REPORT
bugzilla.suse.com/1181622REPORT
bugzilla.suse.com/1182629REPORT
www.suse.com/support/update/announcement/2021/suse-su-20210956-1/Advisory
bugzilla.suse.com/1179816REPORT
bugzilla.suse.com/1180077REPORT
bugzilla.suse.com/1180663REPORT
bugzilla.suse.com/1180721REPORT
www.suse.com/support/update/announcement/2024/suse-su-20242080-1/Advisory
bugzilla.suse.com/1223971REPORT
ubuntu.com/security/CVE-2017-9271REPORT
www.cve.org/CVERecord?id=CVE-2017-9271REPORT
security-tracker.debian.org/tracker/CVE-2017-9271Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities