Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20918-1

Опубликовано: 08 июн. 2026
Источник: suse-cvrf

Описание

Security update for salt

This update for salt fixes the following issues:

Security fixes:

  • CVE-2026-31958: python-tornado: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)

Other changes in salt:

  • Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Harden Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash working for salt-ssh (bsc#1254629)
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831)
  • Fixed virtualenv call in test helper to use proper python version

Список пакетов

openSUSE Leap 16.0
python313-salt-3006.0-160000.5.1
python313-salt-testsuite-3006.0-160000.5.1
salt-3006.0-160000.5.1
salt-api-3006.0-160000.5.1
salt-bash-completion-3006.0-160000.5.1
salt-cloud-3006.0-160000.5.1
salt-doc-3006.0-160000.5.1
salt-fish-completion-3006.0-160000.5.1
salt-master-3006.0-160000.5.1
salt-minion-3006.0-160000.5.1
salt-proxy-3006.0-160000.5.1
salt-ssh-3006.0-160000.5.1
salt-standalone-formulas-configuration-3006.0-160000.5.1
salt-syndic-3006.0-160000.5.1
salt-transactional-update-3006.0-160000.5.1
salt-zsh-completion-3006.0-160000.5.1

Ссылки

Описание

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Затронутые продукты
openSUSE Leap 16.0:python313-salt-3006.0-160000.5.1
openSUSE Leap 16.0:python313-salt-testsuite-3006.0-160000.5.1
openSUSE Leap 16.0:salt-3006.0-160000.5.1
openSUSE Leap 16.0:salt-api-3006.0-160000.5.1
Ссылки