SUSE-SU-2026:2252-1

Source
https://www.suse.com/support/update/announcement/2026/suse-su-20262252-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2252-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:2252-1
Upstream
Related
Published
2026-06-03T14:16:24Z
Modified
2026-06-04T09:00:04Z
Summary
Security update for salt
Details

This update for salt fixes the following issue:

Security issues fixed:

  • CVE-2026-31958: python-tornado: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554).

Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Harden Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
References

Affected packages