Summary
The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.
Security Fix(es):
* urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
* pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | resource-agents | 4.9.0-54.el8_10.4 |
| AlmaLinux · 8 | resource-agents-aliyun | 4.9.0-54.el8_10.4 |
| AlmaLinux · 8 | resource-agents-gcp | 4.9.0-54.el8_10.4 |
| AlmaLinux · 8 | resource-agents-paf | 4.9.0-54.el8_10.4 |
Vulnerabilities 2
-
High 8.8
Remote Code Execution in pypa/setuptools
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index …
-
Medium 4.4
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…