Bug 1615232

Summary:	libzypp: Download of files with infinite size from a malicious mirror
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	besser82, ngompa13
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libzypp 17.5.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-03-04 02:22:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1615233
Bug Blocks:

Description Sam Fowler 2018-08-13 06:02:21 UTC

libzypp before version 17.5.3 does not limit the size of download files allowing for a malicious mirror to serve files of infinite size and fill a client's storage space.


Upstream Patch:

https://github.com/openSUSE/libzypp/pull/128/files

Comment 1 Sam Fowler 2018-08-13 06:02:43 UTC

Created libzypp tracking bugs for this issue:

Affects: fedora-all [bug 1615233]

Comment 2 Neal Gompa 2019-03-04 02:22:05 UTC

This was fixed a long time ago...