CVE-2026-40475

This update for python-pyOpenSSL fixes the following issue

• CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state inconsistency (bsc#1262803).

This update for python-pyOpenSSL fixes the following issue

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

mgr-push:

• Version 5.2.5-0
  • Remove token based authentication mechanism for package_push (bsc#1230949)

spacecmd:

• Version 5.2.10-0
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.7-0
  • Update translation strings

venv-salt-minion:

• CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
• CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)
• CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)
• CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
• CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987)
• CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169)
• CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309)
• CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395)
• CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018)
• CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)
• CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)
• CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)
• CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)
• CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030)
• CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669)
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)
• CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not allow keys with spaces. (bsc#1218722)
• CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)
• CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267)
• CVE-2026-49825: The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285) https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f
• CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser. (bsc#1263254)
• CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode. (bsc#1261970, gh#python/cpython#145264)
• CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)
• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
• CVE-2026-49854: out-of-bounds…

This update fixes the following issues:

mgr-push was updated to version 5.2.5:

• Removed token based authentication mechanism for package_push (bsc#1230949)

spacecmd was updated to version 5.2.10:

• Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Updated translation strings

spacewalk-client-tools was updated to version 5.2.7::

• Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)
  • CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)
  • CVE-2026-41066: Fixed leakage of private system data via…

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…