CVE-2017-9269

CVE-2017-9269 describes a critical vulnerability in libzypp, affecting openSUSE, where GPG keys for YUM repositories were not properly pinned before August 2018. This flaw allowed malicious repository mirrors to silently downgrade to unsigned repositories, potentially delivering malicious content. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low complexity, posing a high risk to confidentiality, integrity, and availability. Despite its severity, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.