Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 616
Alerts This Week
Warning Icon 1 616

Red Hat Enterprise Linux 9 RHSA-2023:2161-01 Moderate DoS Threat Fix

red hat
Calendar Grey May 9, 2023
Dist Redhat Esm H88
The security bulletin from Red Hat highlights a moderate vulnerability fix for the fence-agents package in RHEL 9, tackling a recognized Denial of Service threat.
An update for fence-agents is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* python-oauthlib: DoS when attacker provides malicious IPV6 URI (CVE-2022-36087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory moderate update DoS issue security fix Red Hat Enterprise Linux fence-agents

References

https://access.redhat.com/security/cve/CVE-2022-36087 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: fence-agents-4.10.0-43.el9.src.rpm
aarch64: fence-agents-debuginfo-4.10.0-43.el9.aarch64.rpm fence-agents-debugsource-4.10.0-43.el9.aarch64.rpm fence-agents-kdump-debuginfo-4.10.0-43.el9.aarch64.rpm fence-agents-kubevirt-4.10.0-43.el9.aarch64.rpm fence-agents-kubevirt-debuginfo-4.10.0-43.el9.aarch64.rpm
noarch: fence-agents-common-4.10.0-43.el9.noarch.rpm fence-agents-ibm-powervs-4.10.0-43.el9.noarch.rpm fence-agents-ibm-vpc-4.10.0-43.el9.noarch.rpm fence-agents-virsh-4.10.0-43.el9.noarch.rpm
ppc64le: fence-agents-compute-4.10.0-43.el9.ppc64le.rpm fence-agents-debuginfo-4.10.0-43.el9.ppc64le.rpm fence-agents-debugsource-4.10.0-43.el9.ppc64le.rpm fence-agents-kdump-debuginfo-4.10.0-43.el9.ppc64le.rpm fence-agents-kubevirt-4.10.0-43.el9.ppc64le.rpm fence-agents-kubevirt-debuginfo-4.10.0-43.el9.ppc64le.rpm
s390x: fence-agents-debuginfo-4.10.0-43.el9.s390x.rpm fence-agents-debugsource-4.10.0-43.el9.s390x.rpm fence-agents-kdump-debuginfo-4.10.0-43.el9.s390x.rpm fence-agents-kubevirt-4.10.0-43.el9.s390x.rpm fence-agents-kubevirt-debuginfo-4.10.0-43.el9.s390x.rpm
x86_64: fence-agents-compute-4.10.0-43.el9.x86_64.rpm fence-agents-debuginfo-4.10.0-43.el9.x86_64.rpm fence-agents-debugsource-4.10.0-43.el9.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2023:2161-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2161
Issue date: 2023-05-09

Topic

An update for fence-agents is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate update DoS issue security fix Red Hat Enterprise Linux fence-agents

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux HighAvailability (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux ResilientStorage (v. 9) - noarch, ppc64le, s390x, x86_64

Bugs Fixed

2111998 - fence_ibm_vpc: Add an authentication token caching mechanism (save token in session for configurable interval) (RHEL9)

2121546 - fence_azure_arm fails with 'ServicePrincipalCredentials' object has no attribute 'get_token'

2128425 - CVE-2022-36087 python-oauthlib: DoS when attacker provides malicious IPV6 URI

2132008 - fence_virt: add note that reboot-action doesnt power on nodes that are powered off

2134015 - fence_lpar: only output additional error output on DEBUG level

2138823 - fence_virtd: add link and non-user socket example to man page (RHEL9)

2144531 - fence_virtd: warn when config or key file is not mode 600, and make config file mode 600 for new installs (RHEL9)

2149655 - fence_virtd: add info about using multiple uuid/ip entries for groups (RHEL9)

2160480 - fence_scsi fails to validate (RHEL9)

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.