SUSE-SU-2026:1026-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20261026-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2026:1026-1

Upstream

CVE (6)

Related

CVE (6)

Published

2026-03-25T10:15:30Z

Modified

2026-03-26T09:00:46Z

Summary

Security update 5.0.7 for Multi-Linux Manager Salt Bundle

Details

This update fixes the following issues:

venv-salt-minion:

Security issues fixed:
- CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
- CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
- CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
- CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
- CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
- CVE-2025-13836: Set a safe limit to http.client response read (bsc#1254400)
Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
Use internal deb classes instead of external aptsource lib
Improved performance of wheel key.finger call (bsc#1240532)
Improved performance of utils.find_json function (bsc#1246130)
Extended warn_until period to 2027

References

Affected packages

SUSE:EL-9:Update:Products:SaltBundle:Update

saltbundlepy

Package

Name: saltbundlepy
Purl: pkg:rpm/suse/saltbundlepy&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.11.13-1.38.1

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-core

Package

Name: saltbundlepy-core
Purl: pkg:rpm/suse/saltbundlepy-core&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.11.13-1.38.1

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-m2crypto

Package

Name: saltbundlepy-m2crypto
Purl: pkg:rpm/suse/saltbundlepy-m2crypto&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.45.1-1.18.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-passlib

Package

Name: saltbundlepy-passlib
Purl: pkg:rpm/suse/saltbundlepy-passlib&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.4-1.9.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-passlib-test

Package

Name: saltbundlepy-passlib-test
Purl: pkg:rpm/suse/saltbundlepy-passlib-test&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.4-1.9.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-pyasn1

Package

Name: saltbundlepy-pyasn1
Purl: pkg:rpm/suse/saltbundlepy-pyasn1&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.0-1.12.1

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-pyzmq

Package

Name: saltbundlepy-pyzmq
Purl: pkg:rpm/suse/saltbundlepy-pyzmq&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

25.1.2-1.17.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-simplejson

Package

Name: saltbundlepy-simplejson
Purl: pkg:rpm/suse/saltbundlepy-simplejson&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.19.1-1.12.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-tornado

Package

Name: saltbundlepy-tornado
Purl: pkg:rpm/suse/saltbundlepy-tornado&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.3.2-1.18.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

saltbundlepy-websocket-client

Package

Name: saltbundlepy-websocket-client
Purl: pkg:rpm/suse/saltbundlepy-websocket-client&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.1-1.12.2

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

venv-salt-minion

Package

Name: venv-salt-minion
Purl: pkg:rpm/suse/venv-salt-minion&distro=SUSE:EL-9:Update:Products:SaltBundle:Update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3006.0-1.67.1

Ecosystem specific

{
    "binaries":  [
        {
            "saltbundlepy":  "3.11.13-1.38.1",
            "saltbundlepy-base":  "3.11.13-1.38.1",
            "saltbundlepy-curses":  "3.11.13-1.38.1",
            "saltbundlepy-dbm":  "3.11.13-1.38.1",
            "saltbundlepy-devel":  "3.11.13-1.38.1",
            "saltbundlepy-libs":  "3.11.13-1.38.1",
            "saltbundlepy-m2crypto":  "0.45.1-1.18.2",
            "saltbundlepy-m2crypto-doc":  "0.45.1-1.18.2",
            "saltbundlepy-passlib":  "1.7.4-1.9.2",
            "saltbundlepy-pyasn1":  "0.5.0-1.12.1",
            "saltbundlepy-pyzmq":  "25.1.2-1.17.2",
            "saltbundlepy-pyzmq-devel":  "25.1.2-1.17.2",
            "saltbundlepy-simplejson":  "3.19.1-1.12.2",
            "saltbundlepy-testsuite":  "3.11.13-1.38.1",
            "saltbundlepy-tools":  "3.11.13-1.38.1",
            "saltbundlepy-tornado":  "6.3.2-1.18.2",
            "saltbundlepy-websocket-client":  "1.5.1-1.12.2",
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"

SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS

venv-salt-minion

Package

Name: venv-salt-minion
Purl: pkg:rpm/suse/venv-salt-minion&distro=SUSE%20Manager%20Client%20Tools%20for%20RHEL,%20Liberty%20and%20Clones%209-CLIENT-TOOLS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3006.0-1.67.1

Ecosystem specific

{
    "binaries":  [
        {
            "venv-salt-minion":  "3006.0-1.67.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1026-1.json"