Summary
[4.10.0-98.12]
- bundled cryptography: replace with dependency to fix CVE-2026-26007
- bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
Resolves: RHEL-148436, RHEL-155675
Fixed packages 55
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | fence-agents-aliyun | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-all | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-amt-ws | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-apc | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-apc-snmp | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-aws | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-azure-arm | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-bladecenter | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-brocade | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-cisco-mds | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-cisco-ucs | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-common | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-compute | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-drac5 | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-eaton-snmp | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-emerson | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-eps | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-gce | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-heuristics-ping | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-hpblade | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ibm-powervs | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ibm-vpc | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ibmblade | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ifmib | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ilo-moonshot | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ilo-mp | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ilo-ssh | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ilo2 | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-intelmodular | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ipdu | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-ipmilan | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-kdump | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-kubevirt | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-lpar | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-mpath | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-nutanix-ahv | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-openstack | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-redfish | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-rhevm | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-rsa | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-rsb | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-sbd | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-scsi | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-virsh | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-vmware-rest | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-vmware-soap | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-agents-wti | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virt | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd-cpg | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd-libvirt | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd-multicast | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd-serial | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | fence-virtd-tcp | 0:4.10.0-98.el9_7.12 |
| Oracle Linux · 9 | ha-cloud-support | 0:4.10.0-98.el9_7.12 |
Vulnerabilities 2
-
High 8.2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() a…
-
High 7.5
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…