Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server for SAP 15-SP3 | libzypp-plugin-appdata – < 1.0.1+git.20180426 | 1.0.1+git.20180426 |
| openSUSE | openSUSE Leap 15.4 | libzypp-plugin-appdata – < 1.0.1+git.20180426 | 1.0.1+git.20180426 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | libzypp-plugin-appdata | 1.0.1+git.20180426-150400.18.3.1 | SUSE-SU-2023:0095-1 |
| SLES 15 SP3 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLES 15 SP2 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLES 15 SP1 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLES for SAP 15 SP2 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLES for SAP 15 SP1 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLE Real Time 15 SP3 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLE HPC 15 SP3 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLE HPC 15 SP2 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SLE HPC 15 SP1 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SUSE Enterprise Storage 7.1 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SUSE Enterprise Storage 7 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
| SUSE Enterprise Storage 6 | libzypp-plugin-appdata | 1.0.1+git.20180426-150100.8.3.1 | SUSE-SU-2023:0140-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | libzypp-plugin-appdata | 1.0.1+git.20180426-150400.18.3.1 | SUSE-SU-2023:0095-1 |
Advisories 2
- SUSE-SU-2023:0140-1 Security update for libzypp-plugin-appdata SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0095-1 Security update for libzypp-plugin-appdata SUSE / openSUSE Security Updates · Feb 4, 2026