rpm package
suse/saltbundlepy-cryptography&distro=SUSE:EL-9:Update:Products:SaltBundle:Update
pkg:rpm/suse/saltbundlepy-cryptography&distro=SUSE:EL-9:Update:Products:SaltBundle:Update
Vulnerabilities (13)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-62349 | Med | 6.2 | < 3.3.2-1.21.2 | 3.3.2-1.21.2 | Jan 30, 2026 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to p | |
| CVE-2025-62348 | Hig | 7.8 | < 3.3.2-1.21.2 | 3.3.2-1.21.2 | Jan 30, 2026 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process. | |
| CVE-2024-8088 | Hig | — | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Aug 22, 2024 | There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "na | |
| CVE-2024-7592 | — | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Aug 19, 2024 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in | ||
| CVE-2024-6923 | Med | 5.5 | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Aug 1, 2024 | There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. | |
| CVE-2024-6345 | Hig | 8.8 | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jul 15, 2024 | A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti | |
| CVE-2024-5569 | Med | 6.2 | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jul 9, 2024 | A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as | |
| CVE-2024-3651 | — | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jul 7, 2024 | A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service co | ||
| CVE-2024-37891 | — | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jun 17, 2024 | urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it' | ||
| CVE-2024-0397 | Hig | 7.4 | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jun 17, 2024 | A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the | |
| CVE-2024-4032 | Hig | 7.5 | < 3.3.2-1.18.1 | 3.3.2-1.18.1 | Jun 17, 2024 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr | |
| CVE-2023-20898 | — | < 3.3.2-1.9.2 | 3.3.2-1.9.2 | Sep 5, 2023 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di | ||
| CVE-2023-20897 | — | < 3.3.2-1.9.2 | 3.3.2-1.9.2 | Sep 5, 2023 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. |
- affected < 3.3.2-1.21.2fixed 3.3.2-1.21.2
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to p
- affected < 3.3.2-1.21.2fixed 3.3.2-1.21.2
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "na
- CVE-2024-7592Aug 19, 2024affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as
- CVE-2024-3651Jul 7, 2024affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service co
- CVE-2024-37891Jun 17, 2024affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it'
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the
- affected < 3.3.2-1.18.1fixed 3.3.2-1.18.1
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr
- CVE-2023-20898Sep 5, 2023affected < 3.3.2-1.9.2fixed 3.3.2-1.9.2
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di
- CVE-2023-20897Sep 5, 2023affected < 3.3.2-1.9.2fixed 3.3.2-1.9.2
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.