Summary
This update fixes the following issues:
venv-salt-minion:
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)
- Improved shutdown reliability when the salt-master/minion is terminated
- Fixed broken 'pkg.info_installed' after migration to salt.utils.timeutil
- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.19.1 |
| SUSE · Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.19.1 |
Vulnerabilities 2
-
High 7.2
pyOpenSSL DTLS cookie callback buffer overflow
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL…
-
Low 1.7
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. …
References
-
report
https://bugzilla.suse.com/1254900
-
report
https://bugzilla.suse.com/1255418
-
report
https://bugzilla.suse.com/1257583
-
report
https://bugzilla.suse.com/1259700
-
report
https://bugzilla.suse.com/1259804
-
report
https://bugzilla.suse.com/1259808
-
web
https://www.suse.com/security/cve/CVE-2026-27448
-
web
https://www.suse.com/security/cve/CVE-2026-27459