{"id":"CVE-2026-40475","aliases":["BELL-CVE-2026-40475","SUSE-SU-2026:21617-1","SUSE-SU-2026:21619-1","SUSE-SU-2026:22025-1","SUSE-SU-2026:2259-1","SUSE-SU-2026:2260-1","SUSE-SU-2026:2261-1","SUSE-SU-2026:4580-1","SUSE-SU-2026:4581-1","SUSE-SU-2026:4582-1","SUSE-SU-2026:4583-1","SUSE-SU-2026:4584-1","SUSE-SU-2026:4585-1","openSUSE-SU-2026:10646-1","openSUSE-SU-2026:20897-1"],"status":"published","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-04-28T00:00:00Z","modified":"2026-10-08T19:15:05Z","fixes":[{"ecosystem":"Alpaquita:25","package":"py3-openssl","fixed_in":["25.0.0-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-openssl","fixed_in":["26.1.0-r0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-pyOpenSSL","fixed_in":["25.0.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-pyOpenSSL","fixed_in":["25.0.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pyOpenSSL","fixed_in":["26.1.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-r0"},{"fixed":"25.0.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.0-r0"},{"fixed":"26.1.0-r0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-100002.1.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-80002.3.3.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-80002.5.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-80002.3.9.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-80002.3.9.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-80002.4.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-80002.4.12.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-90002.5.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-90002.3.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-90002.3.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-90002.4.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-90002.4.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-70002.5.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-70002.4.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-70002.4.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-120002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-120002.3.18.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-120002.5.22.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.0-1.1"}]}]}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-40475","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621617-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621619-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622025-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262259-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262260-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262261-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264580-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264581-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264583-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264584-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"BELL-CVE-2026-40475","status":"published","published":"2026-05-10T20:56:19.511454Z","modified":"2026-05-11T07:15:41.807393Z","updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"openSUSE-SU-2026:10646-1","title":"python311-pyOpenSSL-26.1.0-1.1 on GA media","description":"These are all security issues fixed in the python311-pyOpenSSL-26.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-04-29T08:02:31.952428Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20897-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803).\n\n","status":"published","published":"2026-06-03T09:17:47Z","modified":"2026-06-06T18:24:23.184543665Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21617-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n\n","status":"published","published":"2026-05-09T15:43:58Z","modified":"2026-05-16T18:25:17.288641Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21619-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803).\n","status":"published","published":"2026-05-09T16:16:12Z","modified":"2026-05-16T18:25:51.91982Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22025-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803).\n\n","status":"published","published":"2026-06-03T09:16:44Z","modified":"2026-06-09T18:24:28.132646884Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2259-1","title":"Security update for python3-pyOpenSSL","description":"This update for python3-pyOpenSSL fixes the following issue\n\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803).\n","status":"published","published":"2026-06-03T15:31:50Z","modified":"2026-06-04T09:00:04.620599157Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2260-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803).\n","status":"published","published":"2026-06-03T15:31:58Z","modified":"2026-06-04T09:00:04.610873759Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2261-1","title":"Security update for python-pyOpenSSL","description":"This update for python-pyOpenSSL fixes the following issue\n\n\n","status":"published","published":"2026-06-03T15:32:18Z","modified":"2026-06-04T09:00:04.57315863Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:4580-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:17:24Z","modified":"2026-10-08T19:15:04.85537922Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4581-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:18:32Z","modified":"2026-10-08T19:15:03.961471212Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4582-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:20:35Z","modified":"2026-10-08T19:15:03.958892205Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4583-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push:\n\n- Version 5.2.5-0\n  * Remove token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd:\n\n- Version 5.2.10-0\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.7-0\n  * Update translation strings\n\nvenv-salt-minion:\n\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl\n  files. (bsc#1273094)\n- CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)\n- CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)\n- CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)\n- CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959,\n  gh#python/cpython#151987)\n- CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319,\n  gh#python/cpython#148169)\n- CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654,\n  gh#python/cpython#90309)\n- CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098,\n  gh#python/cpython#148395)\n- CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962,\n  gh#python/cpython#149018)\n- CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)\n- CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)\n- CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)\n- CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)\n- CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192,\n  gh#python/cpython#153030)\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file\n  overwrite (bsc#1266669)\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)\n- CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not\n  allow keys with spaces. (bsc#1218722)\n- CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)\n- CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied\n  low-level redirects (bsc#1265267)\n- CVE-2026-49825: The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be\n  used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285)\n  https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\n- CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in ``iterparse()`` and\n  the ``ETCompatXMLParser``. (bsc#1263254)\n- CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode.\n  (bsc#1261970, gh#python/cpython#145264)\n- CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure\n  compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)\n- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)\n- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396)\n- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (bsc#1268397)\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803)\n- CVE-2025-13836: limit http.client response read in NXOS modules (bsc#1254400)\n- Updated bundled python module pip to 25.0.1\n- Updated bundled python module jinja2 to 3.1.6\n- Updated bundled python module lxml to 6.1.1\n- Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n- Remove unused paramiko python module from the bundle.\n- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n- Support attrlist in ldap.managed (bsc#1257151)\n- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:21:47Z","modified":"2026-10-08T19:15:05.005427274Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4584-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7::\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:23:05Z","modified":"2026-10-08T19:15:04.953317343Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}