Red Hat Security Advisory: fence-agents security update

Fixed packages 138

Vulnerabilities 2

• High 7.5
  CVE-2023-37920

  Certifi's removal of e-Tugra root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were…

  certifi python-certifi python-pip certifi Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 25, 2023
• Medium 5.9
  CVE-2023-43804 Public exploit

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

  urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 4, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226586
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242493
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7385.json
• report
  https://access.redhat.com/security/cve/CVE-2023-37920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-37920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-37920
• report
  https://access.redhat.com/security/cve/CVE-2023-43804
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43804
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43804