Summary
[4.9.0-54.27]
- bundled urllib3: fix CVE-2025-66471
- bundled urllib3: fix CVE-2026-21441
Resolves: RHEL-139760, RHEL-140787
[4.9.0-54.24]
- bundled urllib3: fix CVE-2025-66418
Resolves: RHEL-136031
[4.9.0-54.23]
- nfsserver: add ability to set e.g. 'pipefs-directory=/run/nfs/rpc_pipefs'
in /etc/nfs.conf to avoid issues with non-clustered Kerberized mounts
Resolves: RHEL-102979
[4.9.0-54.21]
- db2: fix monitor_retries_sleep variable name
Resolves: RHEL-124815
[4.9.0-54.20]
- portblock: add promotable support, and method and status_check
parameters
Resolves: RHEL-116150
[4.9.0-54.19]
- db2: use reintegration flag to avoid race condition on cluster
reintegration
Resolves: RHEL-118625
[4.9.0-54.17]
- db2: add 'skip_basic_sql_health_check' parameter to avoid failing on
systems with high load
- db2: add 'monitor_retries', 'monitor_sleep', and 'monitor_retry_all_errors'
parameters to be able to avoid failing on first try
Resolves: RHEL-115783, RHEL-115781
[4.9.0-54.16]
- bundled requests: fix CVE-2024-47081
Resolves: RHEL-104761
[4.9.0-54.15]
- ocf-shellfuncs/AWS agents: dont sleep after the final try in
curl_retry()
Resolves: RHEL-102731
[4.9.0-54.13]
- Filesystem: add support for aznfs
Resolves: RHEL-91257
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | resource-agents | 0:4.9.0-54.el8_10.27 |
Vulnerabilities 3
-
High 8.9
urllib3 allows an unbounded number of links in the decompression chain
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadin…
-
High 8.9
urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…
-
High 8.9
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decodi…