FlawAtlas
Search the atlas
ALSA-2024:2968 Not scored

Moderate: fence-agents security and bug fix update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Exploit probability Not scored
Published May 22, 2024
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

AlmaLinux:8 fence-agents-ifmib
AlmaLinux:8 fence-agents-gce
AlmaLinux:8 fence-agents-vmware-soap
AlmaLinux:8 fence-agents-eaton-snmp
AlmaLinux:8 fence-agents-ipdu
AlmaLinux:8 fence-agents-eps
AlmaLinux:8 fence-agents-ipmilan
AlmaLinux:8 fence-agents-ilo-ssh
AlmaLinux:8 fence-agents-cisco-ucs
AlmaLinux:8 fence-agents-zvm
AlmaLinux:8 fence-agents-all
AlmaLinux:8 fence-agents-aws
AlmaLinux:8 fence-agents-bladecenter
AlmaLinux:8 fence-agents-intelmodular
AlmaLinux:8 fence-agents-ilo2
AlmaLinux:8 fence-agents-scsi
AlmaLinux:8 fence-agents-ibm-vpc
AlmaLinux:8 fence-agents-compute
AlmaLinux:8 fence-agents-rsa
AlmaLinux:8 fence-agents-emerson
AlmaLinux:8 fence-agents-lpar
AlmaLinux:8 fence-agents-rsb
AlmaLinux:8 fence-agents-cisco-mds
AlmaLinux:8 fence-agents-ibmblade
AlmaLinux:8 fence-agents-kubevirt
AlmaLinux:8 fence-agents-apc-snmp
AlmaLinux:8 fence-agents-ilo-mp
AlmaLinux:8 fence-agents-openstack
AlmaLinux:8 fence-agents-drac5
AlmaLinux:8 fence-agents-ilo-moonshot
AlmaLinux:8 fence-agents-aliyun
AlmaLinux:8 fence-agents-virsh
AlmaLinux:8 fence-agents-common
AlmaLinux:8 fence-agents-ibm-powervs
AlmaLinux:8 fence-agents-brocade
AlmaLinux:8 fence-agents-redfish
AlmaLinux:8 fence-agents-vmware-rest
AlmaLinux:8 fence-agents-heuristics-ping
AlmaLinux:8 fence-agents-hpblade
AlmaLinux:8 fence-agents-apc
AlmaLinux:8 fence-agents-rhevm
AlmaLinux:8 fence-agents-sbd
AlmaLinux:8 fence-agents-kdump
AlmaLinux:8 fence-agents-azure-arm
AlmaLinux:8 fence-agents-mpath
AlmaLinux:8 fence-agents-wti
AlmaLinux:8 fence-agents-amt-ws

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities ALSA-2024:2968

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

View original source

05 / REFERENCES

Further evidence