« Volver al listado

CVE-2026-44942

Estado: Pendiente de análisisMedia (6.5)—

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Libzypp — LibzyppAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44942",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44942",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-18T12:05:47.827082Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "repo": "https://github.com/opensuse/libzypp",
          "vendor": "SUSE",
          "modules": [
            "repo parsing"
          ],
          "product": "libzypp",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.0",
              "lessThan": "17.38.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "16.22.19",
              "versionType": "semver"
            }
          ],
          "packageName": "libzypp",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-18T14:17:25.903",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1267874",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://www.suse.com/security/cve/CVE-2026-44942.html",
      "source": "meissner@suse.de"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal in handling the \"path\" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content."
    }
  ],
  "lastModified": "2026-06-22T18:32:57.313",
  "sourceIdentifier": "meissner@suse.de"
}