Summary
[4.2.1-129.20]
- bundled urllib3: fix CVE-2025-66471
- bundled urllib3: fix CVE-2026-21441
Resolves: RHEL-139756, RHEL-140783
[4.2.1-129.17]
- bundled urllib3: fix CVE-2025-66418
Resolves: RHEL-136027
[4.2.1-129.16]
- fence_nutanix_ahv: new fence agent
Resolves: RHEL-110964
[4.2.1-129.15]
- fence_kubevirt: use hard poweroff
Resolves: RHEL-96179
[4.2.1-129.14]
- fence_aws: add skip_os_shutdown parameter
Resolves: RHEL-109814
[4.2.1-129.13]
- bundled requests: fix CVE-2024-47081
Resolves: RHEL-104741
[4.2.1-129.12]
- fence_ibm_vpc: add apikey file support
Resolves: RHEL-107506
[4.2.1-129.11]
- fence_aliyun: add credentials file support
Resolves: RHEL-99338
[4.2.1-129.8]
- fence_ibm_powervs: add private endpoint and token file support
Resolves: RHEL-65025
[4.2.1-129.7]
- fence_azure_arm: use azure-identity instead of msrestazure, which has
been deprecated
Resolves: RHEL-76492
Fixed packages 42
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | fence-agents-all | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-amt-ws | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-apc | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-apc-snmp | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-bladecenter | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-brocade | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-cisco-mds | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-cisco-ucs | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-common | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-compute | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-drac5 | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-eaton-snmp | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-emerson | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-eps | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-heuristics-ping | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-hpblade | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ibm-powervs | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ibm-vpc | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ibmblade | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ifmib | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ilo-moonshot | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ilo-mp | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ilo-ssh | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ilo2 | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-intelmodular | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ipdu | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-ipmilan | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-kdump | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-kubevirt | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-lpar | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-mpath | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-nutanix-ahv | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-redfish | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-rhevm | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-rsa | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-rsb | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-sbd | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-scsi | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-virsh | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-vmware-rest | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-vmware-soap | 0:4.2.1-129.el8_10.20 |
| Oracle Linux · 8 | fence-agents-wti | 0:4.2.1-129.el8_10.20 |
Vulnerabilities 3
-
High 8.9
urllib3 allows an unbounded number of links in the decompression chain
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadin…
-
High 8.9
urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…
-
High 8.9
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decodi…