CVE-2025-62349

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

These are all security issues fixed in the python311-salt-3006.0-52.1 package on the GA media of openSUSE Tumbleweed.

This update for salt fixes the following issues:

Changes in salt:

• Add minimum_auth_version to enforce security (CVE-2025-62349)
• Backport security fixes for vendored tornado
  • BDSA-2024-3438
  • BDSA-2024-3439
  • BDSA-2024-9026
• Junos module yaml loader fix (CVE-2025-62348)
• Require Python dependencies only for used Python version
• Fix TLS and x509 modules for OSes with older cryptography module
• Fix Salt for Python > 3.11 (bsc#1252285, bsc#1252244)
• Fix payload signature verification on Tumbleweed (bsc#1251776)
• Fix broken symlink on migration to Leap 16.0 (bsc#1250755)
• Use versioned python interpreter for salt-ssh
• Fix known_hosts error on gitfs (bsc#1250520, bsc#1227207)
• Revert require M2Crypto >= 0.44.0 for SUSE Family distros
• Improve SL Micro 6.2 detection with grains
• Fix the tests failing on AlmaLinux 10 and other clones

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285, bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520, bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

salt:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Fixed functional.states.test_user for SLES 16 and Micro systems
  • Fixed the tests failing on AlmaLinux 10 and other clones
  • Improved SL Micro 6.2 detection with grains
  • Require Python dependencies only for used Python version
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

uyuni-tools:

• Version 0.1.37-0

  • Added --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
  • Added a lowercase version of --logLevel (bsc#1243611)
  • Added migration for server monitoring configuration (bsc#1247688)
  • Added SLE15SP7 to buildin productmap
  • Adjusted traefik exposed configuration for chart v27+ (bsc#1247721)
  • Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)
  • Check for restorecon presence before calling (bsc#1246925)
  • Convert the traefik install time to local time (bsc#1251138)
  • Deprecated --registry
  • Do not require backups to be at the same location for restoring (bsc#1246906)
  • Do not use sudo when running as a root user (bsc#1246882)
  • Fixed channel override for distro copy
  • Fixed loading product map from mgradm configuration file (bsc#1246068)
  • Fixed recomputing proxy images when installing a ptf or test (bsc#1246553)
  • Handle CA files with symlinks during migration (bsc#1251044)
  • Migrate custom auto installation snippets (bsc#1246320)
  • Run smdba and reindex only during migration (bsc#1244534)
  • Stop executing scripts in temporary folder (bsc#1243704)
  • Support config: collect podman inspect for hub container(bsc#1245099)
  • Use new dedicated path for Cobbler settings (bsc#1244027)

• Version 0.1.36-0

  • Bump the default image tag to 5.0.5.1

• Version 0.1.35-0

  • Restore SELinux contexts for restored backup volumes (bsc#1244127)

• Version 0.1.34-0

  • Fixed mgradm backup create handling of images and systemd files (bsc#1246738)

• Version 0.1.33-0

  • Restore volumes using tar instead of podman import (bsc#1244127)

• Version 0.1.32-0

  • Fixed version compare by backport from main (bsc#1246662)

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Added minion_legacy_req_warnings option to avoid noisy warnings

  • Fixed TLS and x509 modules for OSes with older cryptography module

  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)

    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd

  • Filter out zero-length check as the empty files are expected there

  • Filter out env-script-interpreter for ssh-id-wrapper as not used with the Salt Bundle, but present inside the salt module

  • Fixed functional.states.test_user for SLES 16 and Micro systems

  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

  • Fixed payload…

This update for salt fixes the following issues:

salt:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Added minion_legacy_req_warnings option to avoid noisy warnings
  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Fixed functional.states.test_user for SLES 16 and Micro systems
  • Fixed the tests failing on AlmaLinux 10 and other clones
  • Improved SL Micro 6.2 detection with grains
  • Require Python dependencies only for used Python version
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285, bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520, bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285, bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520, bsc#1227207)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285, bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520, bsc#1227207)

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Improved SL Micro 6.2 detection with grains
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Improved SL Micro 6.2 detection with grains
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Improved SL Micro 6.2 detection with grains
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • Backport security fixes for vendored tornado
    • BDSA-2024-3438
    • BDSA-2024-3439
    • BDSA-2024-9026

• Other changes and bugs fixed:

  • Fixed TLS and x509 modules for OSes with older cryptography module
  • Fixed Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
    • Use external tornado on Python > 3.11
    • Make tls and x509 to use python-cryptography
    • Remove usage of spwd
  • Fixed payload signature verification on Tumbleweed (bsc#1251776)
  • Fixed broken symlink on migration to Leap 16.0 (bsc#1250755)
  • Fixed known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  • Improved SL Micro 6.2 detection with grains
  • Reverted requirement of M2Crypto >= 0.44.0 for SUSE Family distros
  • Set python-CherryPy as required for python-salt-testsuite

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.16.2
  • SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
  • CVEs Fixed: CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190 CVE-2025-62349, CVE-2025-62348
  • Bugs mentioned: bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0
  • Disable build for SLES 16

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0
  • Disable build for SLES 16

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)
• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

golang-github-prometheus-prometheus:

• CVE-2026-27606: Fix arbitrary file write via path traversal in rollup (bsc#1258893)
  • Bump rollup to version 4.59.0
• Drop SLE 12 support (jsc#PED-15474)
• CVE-2026-25547: Fix unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841):
  • Bump brace-expansion to version 5.0.2
• Do not build old web UI. Fixes following security vulnerabilities:
  • CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions (bsc#1257897)
  • CVE-2025-61140: jsonpath: the value function is vulnerable to prototype pollution (bsc#1257442)
• Set source URL in the spec file and drop tar service

grafana:

• Drop support for SLE 12 (jsc#PED-15474)
• Update to version 11.6.11: Features and enhancements:
  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
• Update to version 11.6.10:
  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID
• Update to version 11.6.9:
  • Plugins: Add PluginContext to plugins when scenes is disabled
  • Alerting: Fix contacts point issues
• Update to version 11.6.8:
  • Alerting: Fix unmarshalling of GettableStatus to include time intervals
• Update to version 11.6.7:
  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)
• Update to version 11.6.6:
  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath
• Update to version 11.6.5:
  • Alerting: Bump alerting package to include change to NewTLSClient
• Update to version 11.6.4:
  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows
• Update to version 11.6.3:
  • Fixes CVE-2025-3415
• Update to version 11.6.2:
  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path
• Update to version 11.6.1:
  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs
• Upgrade to version 11.6.0:
  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history
  • API keys: Migrate API keys to service accounts at startup

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0 …

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)