Summary
[4.10.0-110.8]
- bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266,
CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272
Resolves: RHEL-281011, RHEL-281460, RHEL-286482, RHEL-278388, RHEL-281053
Fixed packages 55
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | fence-agents-aliyun | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-all | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-amt-ws | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-apc | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-apc-snmp | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-aws | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-azure-arm | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-bladecenter | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-brocade | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-cisco-mds | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-cisco-ucs | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-common | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-compute | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-drac5 | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-eaton-snmp | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-emerson | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-eps | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-gce | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-heuristics-ping | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-hpblade | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ibm-powervs | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ibm-vpc | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ibmblade | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ifmib | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ilo-moonshot | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ilo-mp | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ilo-ssh | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ilo2 | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-intelmodular | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ipdu | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-ipmilan | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-kdump | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-kubevirt | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-lpar | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-mpath | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-nutanix-ahv | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-openstack | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-redfish | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-rhevm | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-rsa | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-rsb | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-sbd | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-scsi | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-virsh | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-vmware-rest | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-vmware-soap | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-agents-wti | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virt | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd-cpg | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd-libvirt | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd-multicast | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd-serial | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | fence-virtd-tcp | 0:4.10.0-110.el9_8.8 |
| Oracle Linux · 9 | ha-cloud-support | 0:4.10.0-110.el9_8.8 |
Vulnerabilities 5
-
Critical 9.1CVE-2026-102268 Public exploit
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…
-
High 7.4
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…
-
High 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…
-
High 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …
-
High 7.4
PyJWT BOM Bypass
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…