diff --git a/libzypp-17.25.3.tar.bz2 b/libzypp-17.25.3.tar.bz2
index ce1d440..5834206 100644
--- a/libzypp-17.25.3.tar.bz2
+++ b/libzypp-17.25.3.tar.bz2
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:c788925a783110115eda2ee5e24cbfb8ba79540f7478d2789d75ebebc77249b4
-size 4790059
+oid sha256:01eb177fda47e1998fb7743df36933559980c0dcae7c888c9f75a98d1faa941a
+size 4790345
diff --git a/libzypp.changes b/libzypp.changes
index c814f18..95ef2f1 100644
--- a/libzypp.changes
+++ b/libzypp.changes
@@ -6,8 +6,8 @@ Fri Nov 27 10:17:50 CET 2020 - ma@suse.de
 - RpmDb: If no database exists use the _dbpath configured in rpm.
   Still makes sure a compat symlink at /var/lib/rpm exists in case
   the configures _dbpath is elsewhere. (bsc#1178910)
-- Url: Hide known password entires when writing the query part
-  (bsc#1050625 bsc#1177583)
+- Url: Hide known password entries when writing the query part
+  (bsc#1050625 bsc#1177583, CVE-2017-9271)
 - adapt testcase to change introduced by libsolv#402.
 - RepoManager: Force refresh if repo url has changed (bsc#1174016)
 - RepoInfo: ignore legacy type= in a .repo file and let RepoManager