openSUSE Ships Moderate Rated Update Correcting Two Impacket Package Flaws on Tumbleweed
openSUSE has issued advisory openSUSE-SU-2026:12011-1, a moderate rated update that resolves two vulnerabilities in the Impacket packages shipped on openSUSE Tumbleweed GA media. The fixed builds are python313-impacket 0.13.1-1.2 and python314-impacket 0.13.1-1.2. The advisory cross references CVE-2020-17049, scored 7.2 by SUSE, and CVE-2021-31800, scored 9.8. Impacket is a widely deployed Python library for working with network protocols such as SMB and MSRPC, and it underpins administration, testing and automation tooling across many Linux estates. Tumbleweed systems carrying earlier package builds are in scope.
The advisory itself does not publish exploitation details for either flaw, and no proof of concept is referenced. What is known comes from the CVSS vectors. CVE-2021-31800 carries AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning a network reachable attacker needs no privileges and no user interaction to achieve full compromise of confidentiality, integrity and availability. CVE-2020-17049 uses AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so an attacker already holding high privileges can reach the same outcome over the network. Both issues are addressed in the 0.13.1-1.2 package builds now on GA media.
These libraries typically sit on administrative workstations, jump hosts and automation servers, systems that often hold elevated credentials, so a compromise there carries outsized lateral movement value. FIRST EPSS places CVE-2020-17049 at a 13.8 percent probability of exploitation within the next thirty days and CVE-2021-31800 at 19.4 percent, both above the typical baseline for patched library flaws. Neither CVE is reported as exploited in the wild in this advisory, and no active campaign is described. The exposure is therefore unpatched Tumbleweed hosts running older Impacket builds.
Attack Surface
Server OS, Endpoint OS
Tactics
Privilege Escalation, Credential Access, Lateral Movement
Techniques
- T1210 – Exploitation of Remote Services
- T1558 – Steal or Forge Kerberos Tickets
- T1550.003 – Use Alternate Authentication Material: Pass the Ticket
SuperPRO's Threat Countermeasures Procedures
- Install the fixed packages from openSUSE Tumbleweed GA media: python313-impacket 0.13.1-1.2 and python314-impacket 0.13.1-1.2, per advisory openSUSE-SU-2026:12011-1.
- Inventory Tumbleweed hosts with 'zypper se -s impacket' and 'rpm -q python313-impacket python314-impacket' to confirm the installed release is 0.13.1-1.2 or later before closing the ticket.
- Apply the openSUSE-SU-2026:12011-1 content on Tumbleweed hosts with 'zypper refresh' followed by 'zypper dup', which is the route by which the 0.13.1-1.2 Impacket builds on GA media reach installed systems.
- Cover both package flavours named in the advisory in the same change, python313-impacket and python314-impacket, as a Tumbleweed host may carry the Impacket library for the Python 3.13 interpreter, the Python 3.14 interpreter or both.
- Sequence the work by the scores published in openSUSE-SU-2026:12011-1, taking CVE-2021-31800 at 9.8 ahead of CVE-2020-17049 at 7.2 where the 0.13.1-1.2 builds cannot be rolled out to every Tumbleweed host at once.
- Confirm with 'zypper lr -u' that the openSUSE Tumbleweed GA media repository is enabled and reachable on each host, since systems pinned to an older snapshot or with that repository disabled will not receive the 0.13.1-1.2 Impacket packages.
- Run 'zypper ps -s' after the update completes and restart any long running Python processes on the host that still hold the pre-0.13.1-1.2 Impacket files open, so the patched library is actually in use.
