Summary
[4.10.0-62]
- bundled urllib3: fix CVE-2023-45803
Resolves: RHEL-18139
- bundled pycryptodome: fix CVE-2023-52323
Resolves: RHEL-20917
- bundled jinja2: fix CVE-2024-22195
Resolves: RHEL-21345
[4.10.0-61]
- fence_zvmip: document required user permissions in metadata/manpage
Resolves: RHEL-14344
[4.10.0-60]
- all agents: update metadata in non-I/O agents to Power or Network
fencing
Resolves: RHEL-14030
[4.10.0-57]
- bundled urllib3: fix CVE-2023-43804
Resolves: RHEL-11999
[4.10.0-56]
- fence_scsi: fix registration handling if ISID conflicts
Resolves: RHEL-5396
- bundled certifi: fix CVE-2023-37920
Resolves: RHEL-9446
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | fence-agents-common | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-agents-compute | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-agents-ibm-powervs | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-agents-ibm-vpc | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-agents-kubevirt | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-agents-virsh | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virt | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd-cpg | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd-libvirt | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd-multicast | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd-serial | 0:4.10.0-62.el9 |
| Oracle Linux · 9 | fence-virtd-tcp | 0:4.10.0-62.el9 |
Vulnerabilities 3
-
Medium 5.9
PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption
PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.
-
Medium 5.4
Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …
-
Medium 4.2
Request body not stripped after redirect in urllib3
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…