CVE-2025-67726

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Summary

The _parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count() within a nested loop while processing quoted semicolons (e.g., param=";").

As a result, if an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period, leading to a Denial of Service (DoS).

Severity: High

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.(CVE-2025-67726)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.(CVE-2025-67726)

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

• tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)
• tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.

Tornado vulnerable to Header Injection and XSS via reason argument. (CVE-2025-67724) Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing. (CVE-2025-67725) Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters. (CVE-2025-67726)

These are all security issues fixed in the python311-tornado6-6.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-salt-3006.0-55.1 package on the GA media of openSUSE Tumbleweed.

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: unescaped reason argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903).
• CVE-2025-67725: quadratic complexity of string concatenation operations used by the HTTPHeaders.add method can lead o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
• CVE-2025-67726: quadratic complexity algorithm used in the _parseparam function of httputil.py can lead to DoS when processing maliciously crafted parameters in a Content-Disposition header (bsc#1254904).

This update for salt fixes the following issues:

Changes in salt:

• Security issues fixed:

  • CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extend warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: unescaped reason argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903).
• CVE-2025-67725: quadratic complexity of string concatenation operations used by the HTTPHeaders.add method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905).
• CVE-2025-67726: quadratic complexity algorithm used in the _parseparam function of httputil.py can lead to DoS when processing maliciously crafted parameters in a Content-Disposition header (bsc#1254904).

This update for python-tornado fixes the following issues:

• CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905).
• CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904).

This update for python-tornado fixes the following issues:

• CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905).
• CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904).

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Non-customer-facing optimization around source building

golang-github-lusitaniae-apache_exporter:

• Build without apparmor for openSUSE Leap 16, SLES 16 or newer
• Require Go 1.23 for building
• Update to version 1.0.10
  • Update github.com/prometheus/client_golang to 1.21.1
  • Update github.com/prometheus/common to 0.63.0
  • Update github.com/prometheus/exporter-toolkit to 0.14.0
• Update to version 1.0.9
  • Update github.com/prometheus/client_golang to 1.20.4
  • Update github.com/prometheus/common to 0.59.1
  • Update github.com/prometheus/exporter-toolkit to 0.13.0
  • Migrate logging to log/slog
  • Fix signal handler logging

scap-security-guide:

• Updated to 0.1.79 (jsc#ECO-3319)
  • Add rhcos4 Profile for BSI Grundschutz
  • Create SLE15 general profile
  • Remove OCP STIG V1R1
  • Remove OCP STIG V2R1
  • Various updates for SLE 12/15
• Updated to 0.1.78 (jsc#ECO-3319)
  • Enable SCE content for problematic rules that can traverse the whole filesystem
  • Remove unnecessary Jinja2 macros in control files
  • Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  • Add Debian 13 profile for ANSSI BP 28 (enhanced)
  • Create SLEM5 General profile
  • Create SL Micro 6 product and general profile
  • Update SLE15 STIG version to V2R5
  • Update SLE12 STIG version to V3R3
  • Update SLEM5 STIG version to V1R2
• Remove the CIS profiles from all products
• Remove the CIS profiles from the tarball

spacecmd:

• Version 5.1.12-0
  • Fix spacecmd binary file upload (bsc#1253659)
  • Fix typo in spacecmd help ca-cert flag (bsc#1253174)
  • Convert cached IDs to int (bsc#1251995)
  • Fix methods in api namespace in spacecmd (bsc#1249532)
  • Make caching code Py 2.7 compatible
  • Use JSON instead of pickle for spacecmd cache (bsc#1227579)
  • Python 2.7 cannot re-raise exceptions

uyuni-tools:

• Version 5.1.24-0
  • Actually use the --dbupgrade-tag parameter when computing the image URL (bsc#1249400)
  • Handle CA files with symlinks during migration (bsc#1251044)
  • Adjust traefik exposed configuration for chart v27+ (bsc#1247721)
  • Fix systemd object initialization in server rename. (bsc#1250981)
  • Add SSL secrets to the db setup container during migration. (bsc#1250976)
  • Fix images handling in mgrpxy support ptf (bsc#1250940)
  • Fix helm upgrade parameters (bsc#1253966)
  • Detect custom apache and squid config in the /etc/uyuni/proxy folder
  • Add ssh tuning to configure sshd (bsc#1253738)
  • Move the SSL checks at the beginning of the migration
  • Remove cgroup mount for podman containers (bsc#1253347)
  • Convert the traefik install time to local time (bsc#1251138)
  • During migration, krb5.conf.d should be copied in /etc/rhn (bsc#1254478)
  • Read env var from http conf file (bsc#1253282)
  • Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
  • Deprecate --registry
  • Unify backup create and restore dryrun option case
  • Fix calling of squid -z in mgrpxy cache clear (bsc#1247644)
  • Always start database container even if enabled
  • Remove extra ipv6 mapping and nftables workaround (bsc#1248848)
  • Remove old PostgreSQL exporter environment file before migration
  • Support config command parse correctly supportconfig output (bsc#1255781)
• Version 5.1.23-0
  • Update the default tag
• Version 5.1.22-0
  • Fix cobbler config migration to standalone files
  • Fix generated DB certificate subject alternate names
• Version 5.1.21-0
  • Remove extraneous quotes when getting the running image (bsc#1249434)

venv-salt-minion:

• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• Make syntax…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Non-customer-facing optimization around source building

golang-github-lusitaniae-apache_exporter:

• Build without apparmor for openSUSE Leap 16, SLES 16 or newer
• Require Go 1.23 for building
• Update to version 1.0.10
  • Update github.com/prometheus/client_golang to 1.21.1
  • Update github.com/prometheus/common to 0.63.0
  • Update github.com/prometheus/exporter-toolkit to 0.14.0
• Update to version 1.0.9
  • Update github.com/prometheus/client_golang to 1.20.4
  • Update github.com/prometheus/common to 0.59.1
  • Update github.com/prometheus/exporter-toolkit to 0.13.0
  • Migrate logging to log/slog
  • Fix signal handler logging

scap-security-guide:

• Updated to 0.1.79 (jsc#ECO-3319)
  • Add rhcos4 Profile for BSI Grundschutz
  • Create SLE15 general profile
  • Remove OCP STIG V1R1
  • Remove OCP STIG V2R1
  • Various updates for SLE 12/15
• Updated to 0.1.78 (jsc#ECO-3319)
  • Enable SCE content for problematic rules that can traverse the whole filesystem
  • Remove unnecessary Jinja2 macros in control files
  • Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  • Add Debian 13 profile for ANSSI BP 28 (enhanced)
  • Create SLEM5 General profile
  • Create SL Micro 6 product and general profile
  • Update SLE15 STIG version to V2R5
  • Update SLE12 STIG version to V3R3
  • Update SLEM5 STIG version to V1R2
• Remove the CIS profiles from all products
• Remove the CIS profiles from the tarball

spacecmd:

• Version 5.1.12-0
  • Fix spacecmd binary file upload (bsc#1253659)
  • Fix typo in spacecmd help ca-cert flag (bsc#1253174)
  • Convert cached IDs to int (bsc#1251995)
  • Fix methods in api namespace in spacecmd (bsc#1249532)
  • Make caching code Py 2.7 compatible
  • Use JSON instead of pickle for spacecmd cache (bsc#1227579)
  • Python 2.7 cannot re-raise exceptions

venv-salt-minion:

• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• Make syntax in httputil_test compatible with Python 3.6
• Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
• Use internal deb classes instead of external aptsource lib
• Speed up wheel key.finger call (bsc#1240532)
• Simplify and speed up utils.find_json function (bsc#1246130)
• Extend warn_until period to 2027

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Non-customer-facing optimization around source building

golang-github-lusitaniae-apache_exporter:

• Build without apparmor for openSUSE Leap 16, SLES 16 or newer
• Require Go 1.23 for building
• Update to version 1.0.10
  • Update github.com/prometheus/client_golang to 1.21.1
  • Update github.com/prometheus/common to 0.63.0
  • Update github.com/prometheus/exporter-toolkit to 0.14.0
• Update to version 1.0.9
  • Update github.com/prometheus/client_golang to 1.20.4
  • Update github.com/prometheus/common to 0.59.1
  • Update github.com/prometheus/exporter-toolkit to 0.13.0
  • Migrate logging to log/slog
  • Fix signal handler logging

mgr-push:

• Version 5.1.5-0
  • Non-customer-facing optimization and update

rhnlib:

• Version 5.1.4-0
  • Non-customer-facing optimization and update

spacecmd:

• Version 5.1.12-0
  • Fix spacecmd binary file upload (bsc#1253659)
  • Fix typo in spacecmd help ca-cert flag (bsc#1253174)
  • Convert cached IDs to int (bsc#1251995)
  • Fix methods in api namespace in spacecmd (bsc#1249532)
  • Make caching code Py 2.7 compatible
  • Use JSON instead of pickle for spacecmd cache (bsc#1227579)
  • Python 2.7 cannot re-raise exceptions

spacewalk-client-tools:

• Version 5.1.8-0
  • Non-customer-facing optimization and update

uyuni-common-libs:

• Version 5.1.5-0
  • Non-customer-facing optimization and update

venv-salt-minion:

• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• Make syntax in httputil_test compatible with Python 3.6
• Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
• Use internal deb classes instead of external aptsource lib
• Speed up wheel key.finger call (bsc#1240532)
• Simplify and speed up utils.find_json function (bsc#1246130)
• Extend warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• Make syntax in httputil_test compatible with Python 3.6
• Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
• Use internal deb classes instead of external aptsource lib
• Speed up wheel key.finger call (bsc#1240532)
• Simplify and speed up utils.find_json function (bsc#1246130)
• Extend warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Backported security patches for Salt vendored tornado:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)

• Made syntax in httputil_test compatible with Python 3.6

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Speed up wheel key.finger call (bsc#1240532)

• Improved utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
  • CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Made syntax in httputil_test compatible with Python 3.6

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved wheel key.finger call (bsc#1240532)

• Improved utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Made syntax in httputil_test compatible with Python 3.6

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved wheel key.finger call (bsc#1240532)

• Improved utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Made syntax in httputil_test compatible with Python 3.6

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved wheel key.finger call (bsc#1240532)

• Improved utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Made syntax in httputil_test compatible with Python 3.6

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved wheel key.finger call (bsc#1240532)

• Improved utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0
  • Disable build for SLES 16

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0
  • Disable build for SLES 16

uyuni-tools:

• Version 5.2.5-0
  • Remove migrate command
  • Remove template script from mgradm: use the one in the image
  • Split the TFTP server into a separate container
  • Explicitly start proxy pods after operations (bsc#1258015)
  • Adjust mgrctl server filter to work with the new helm chart labels
  • Remove hub register command
  • Remove the Kubernetes install and upgrade from mgrpxy
  • Optimize postgres migration disk space usage (bsc#1257447)

venv-salt-minion:

• Fix the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)
• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update fixes the following issues:

golang-github-prometheus-prometheus:

• CVE-2026-27606: Fix arbitrary file write via path traversal in rollup (bsc#1258893)
  • Bump rollup to version 4.59.0
• Drop SLE 12 support (jsc#PED-15474)
• CVE-2026-25547: Fix unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841):
  • Bump brace-expansion to version 5.0.2
• Do not build old web UI. Fixes following security vulnerabilities:
  • CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions (bsc#1257897)
  • CVE-2025-61140: jsonpath: the value function is vulnerable to prototype pollution (bsc#1257442)
• Set source URL in the spec file and drop tar service

grafana:

• Drop support for SLE 12 (jsc#PED-15474)
• Update to version 11.6.11: Features and enhancements:
  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
• Update to version 11.6.10:
  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID
• Update to version 11.6.9:
  • Plugins: Add PluginContext to plugins when scenes is disabled
  • Alerting: Fix contacts point issues
• Update to version 11.6.8:
  • Alerting: Fix unmarshalling of GettableStatus to include time intervals
• Update to version 11.6.7:
  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)
• Update to version 11.6.6:
  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath
• Update to version 11.6.5:
  • Alerting: Bump alerting package to include change to NewTLSClient
• Update to version 11.6.4:
  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows
• Update to version 11.6.3:
  • Fixes CVE-2025-3415
• Update to version 11.6.2:
  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path
• Update to version 11.6.1:
  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs
• Upgrade to version 11.6.0:
  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history
  • API keys: Migrate API keys to service accounts at startup

mgr-push:

• Version 5.2.3-0
  • Disable build for SLES 16

rhnlib:

• Version 5.2.4-0
  • Disable build for SLES 16

spacecmd:

• Version 5.2.6-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.4-0
  • Disable build for SLES 16

uyuni-common-libs:

• Version 5.2.3-0 …

This update fixes the following issues:

spacecmd:

• Version 5.2.6-0
  • Update translation strings

venv-salt-minion:

• Fix the typo causing buiding EL9 bundle without binary dependencies
• Backport security patches for Salt vendored tornado:
  • CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
• CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
• CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: unescaped reason argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903).
• CVE-2025-67725: quadratic complexity of string concatenation operations used by the HTTPHeaders.add method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905).
• CVE-2025-67726: quadratic complexity algorithm used in the _parseparam function of httputil.py can lead to DoS when processing maliciously crafted parameters in a Content-Disposition header (bsc#1254904).

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: unescaped reason argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903).
• CVE-2025-67725: quadratic complexity of string concatenation operations used by the HTTPHeaders.add method can lead o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
• CVE-2025-67726: quadratic complexity algorithm used in the _parseparam function of httputil.py can lead to DoS when processing maliciously crafted parameters in a Content-Disposition header (bsc#1254904).

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: Fixed missing validation of the supplied reason phrase (bsc#1254903)
• CVE-2025-67725: Fixed inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905)
• CVE-2025-67726: Fixed Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904)

This update for python-tornado6 fixes the following issues:

• CVE-2025-67724: unescaped reason argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903).
• CVE-2025-67725: quadratic complexity of string concatenation operations used by the HTTPHeaders.add method can lead o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
• CVE-2025-67726: quadratic complexity algorithm used in the _parseparam function of httputil.py can lead to DoS when processing maliciously crafted parameters in a Content-Disposition header (bsc#1254904).

This update for salt fixes the following issues:

• Security issues fixed:

  • CVE-2025-67724: Fixed missing validation of supplied reason phrase (bsc#1254903)
  • CVE-2025-67725: Fixed DoS via malicious HTTP request (bsc#1254905)
  • CVE-2025-67726: Fixed HTTP header parameter parsing algorithm (bsc#1254904)
  • CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)

• Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)

• Use internal deb classes instead of external aptsource lib

• Improved performance of wheel key.finger call (bsc#1240532)

• Improved performance of utils.find_json function (bsc#1246130)

• Extended warn_until period to 2027