SUSE-SU-2026:4583-1: mgr-push&distro=SUSE Multi Linux Manager Tools RES-7 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4583-1 is a vulnerability in mgr-push&distro=SUSE Multi Linux Manager Tools RES-7 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

Security update 5.2.1 for Multi-Linux Manager Client Tools This update fixes the following issues: mgr-push: - Version 5.2.5-0 * Remove token based authentication mechanism for package_push (bsc#1230949) spacecmd: - Version 5.2.10-0 * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261) - Version 5.2.9-0 * Update translation strings spacewalk-client-tools: - Version 5.2.7-0 * Update translation strings venv-salt-minion: - CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl files. (bsc#1273094) - CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927) - CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211) - CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079) - CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987) - CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169) - CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309) - CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395) - CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018) - CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486) - CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268) - CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977) - CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981) - CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030) - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669) - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442) - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429) - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599, gh#pypa/pip#13777) - CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not allow keys with spaces. (bsc#1218722) - CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413) - CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267) - CVE-2026-49825: The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285) https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f - CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in ``iterparse()`` and the ``ETCompatXMLParser``. (bsc#1263254) - CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode. (bsc#1261970, gh#python/cpython#145264) - CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121) - CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428) - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395) - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396) - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (bsc#1268397) - CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state inconsistency (bsc#1262803) - CVE-2025-13836: limit http.client response read in NXOS modules (bsc#1254400) - Updated bundled python module pip to 25.0.1 - Updated bundled python module jinja2 to 3.1.6 - Updated bundled python module lxml to 6.1.1 - Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613) - Remove unused paramiko python module from the bundle. - Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286) - Support attrlist in ldap.managed (bsc#1257151) - Use AsyncHTTPClient in salt.utils.http (bsc#1268325) - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)

No weakness data has been published for this record.