🛡️ SUSE-SU-2025:20504-1 — salt (CVE-2025-22870 +12 more)

Security update 5.0.5 for Multi-Linux Manager Client Tools, Salt and Salt Bundle

This update fixes the following issues:

golang-github-prometheus-node_exporter:

• Security issues fixed:
• CVE-2025-22870: Prevent a matching of hosts against proxy patterns to improperly treat an IPv6 zone ID as a

hostname component (bsc#1238686)

• Other bugs fixed:
• Fixed Darwin memory leak
• pressure: Fix missing IRQ on older kernels

salt, venv-salt-minion:

• Security issues fixed:
• CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
• CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
• CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
• CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
• CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
• CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
• CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
• CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
• CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
• CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
• CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
• CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)
• Other bugs fixed:
• Added subsystem filter to udev.exportdb (bsc#1236621)
• Added minion_legacy_req_warnings option to avoid noisy warnings
• Fixed Ubuntu 24.04 edge-case test failures
• Fixed refresh of osrelease and related grains on Python 3.10+
• Fixed issue requiring proper Python flavor for dependencies
• Require M2Crypto version 0.44.0 or higher
• venv-salt-minion: Fixed bundle path in pyvenv.cfg

uyuni-tools:

• Version 0.1.31-0:
• Added the info message about End User License Agreement
• Don't migrate py2*-compat-salt.conf files (bsc#1240626)
• Check for restorecon before using it (bsc#1240698)
• Adjust the distro path in cobbler files after migration

(bsc#1238929)

• Added mgradm support ptf podman --pullPolicy flag (bsc#1236877)
• Support: don't dump files in bound folders (bsc#1243297)
• Cleanup host supportconfig files (bsc#1242174)
• During migration, check if backup already exists (bsc#1243105)
• Removed SHM size limits from all containers (bsc#1243274)
• Don't migrate /etc/apache2/vhosts.d/cobbler.conf
• Fixed migration --prepare for autoinstallable distributions (bsc#1243802)
• Skip instalation if the server is already set up (bsc#1238849)
• Bumped the default image tag to 5.0.5