ALSA-2022:6314 Copyright 2022 AlmaLinux OS 0 1 Important

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: obtaining an authentication token for hacluster user could lead to privilege escalation (CVE-2022-2735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_6_default pcs-0.10.12-6.el8_6.2.alma.s390x.rpm 4d482071ac2d835e19d0e98f7e367324a99c448388c6c88bcc0b759200234026 pcs-snmp-0.10.12-6.el8_6.2.alma.s390x.rpm e7be3a19141d45b89a3a998af8d90ab5fbc89f2acdfd5921d33fc4718e9f6802 ALSA-2022:6439 Copyright 2022 AlmaLinux OS 0 1 Moderate

booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time. Security Fix(es): * booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_6_default booth-arbitrator-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm 01c0dac9a8f42077035f4e5c03b5449c69c6f6a9c80ae995d05dcde15ca8a6a7 booth-site-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm 49521ed948e3e12ec2970897efe740f7dca8ad85091475b4e3edb8c07cacdc45 booth-test-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm 9ba23dd05371c3e52f54f1a8d5ad6d78a1fb9a9aabf50b24d14888b0d7679a41 booth-core-1.0-199.1.ac1d34c.git.el8_6.1.s390x.rpm ee6c5196d65b4c57660a299d2c978f100206b827ba9444c2b3c04d608e2a2015 booth-1.0-199.1.ac1d34c.git.el8_6.1.s390x.rpm fa1fe771e8d2194a798c3ef46eef07e2edd0d9615027c1402219eaf7949e7406 ALSA-2022:7447 Copyright 2022 AlmaLinux OS 0 1 Moderate

pcs security, bug fix, and enhancement update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: improper authentication via PAM (CVE-2022-1049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_6_default pcs-0.10.14-5.el8.alma.s390x.rpm f8417d62e0c9a09f14c3d1841d8c74fb82144e1e2539a9e0ead719d9efdc1692 pcs-snmp-0.10.14-5.el8.alma.s390x.rpm fada59c8fa4d6bae321d7932c7fcf3b7cc47d7daf2c3f4d2e112034f730cddeb ALSA-2023:0855 Copyright 2023 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: Reflected File Download attack (CVE-2022-45442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_7_default pcs-0.10.14-5.el8_7.2.alma.s390x.rpm 07229c553dddee89b4d6b2e1fb5a848ba0450ea1e9f990157fdacda127f0592f pcs-snmp-0.10.14-5.el8_7.2.alma.s390x.rpm 4f8679020a6bc724b5339204b23c4fb7c45694da6eb818e5de9f64b2eea10a0b ALSA-2023:3082 Copyright 2023 AlmaLinux OS 0 1 Moderate

pcs security and bug fix update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530) * rubygem-rack: denial of service in header parsing (CVE-2023-27539) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700) * Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_8_default pcs-0.10.15-4.el8_8.1.alma.s390x.rpm 66f71e2f6e0160dc9b8151d8d9e759f4fe35af112978f2cc94d1c3a338386fda pcs-snmp-0.10.15-4.el8_8.1.alma.s390x.rpm 6d0a028d15caa51274b3d750f6533fd25c025f462df16db1b0933cc523e0b00e ALSA-2024:0133 Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_9_default fence-agents-gce-4.2.1-121.el8_9.2.noarch.rpm 0c7776519266cc3263a151d656ff9cb501ac468296924d76f14799c459481089 fence-agents-aws-4.2.1-121.el8_9.2.noarch.rpm c3f7208166961e82959b9bc2716cced703de69529611665f59d94025dacf18da fence-agents-azure-arm-4.2.1-121.el8_9.2.noarch.rpm cf0b1e45f7cb71573a7d1186baadb5f2a229193431a625ee04aaaa42cc3fee43 ALSA-2024:10987 Copyright 2025 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header (CVE-2024-21510) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-0.10.18-2.el8_10.3.alma.1.s390x.rpm 49cabfd758b3cc1ff6a18d4a14974fa316375c899344a50c9df3c3e9e6ead7e5 pcs-snmp-0.10.18-2.el8_10.3.alma.1.s390x.rpm 9cc89564a27a6bd6434f99526650669563903bb42bb868a164fcc1343703d68d ALSA-2024:2952 Copyright 2024 AlmaLinux OS 0 1 Moderate

resource-agents security and bug fix update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_9_default resource-agents-4.9.0-54.el8.s390x.rpm 08f70e3e66d714ee03098f02da4a05c7bc242e5359af4b1b666d3c33c893a5ed resource-agents-paf-4.9.0-54.el8.s390x.rpm 0d38c43b065b3e3a8c8a886cea264c73194accad294546c6ede1acd53eb1426d ALSA-2024:2953 Copyright 2024 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_9_default pcs-snmp-0.10.18-2.el8_10.s390x.rpm 49d0f258ce79a8f41f8b895d3905bc9cfb0efa6a5a13c60fc56e07145aa6ae9a pcs-0.10.18-2.el8_10.s390x.rpm 5d48b97db0c498a642db246606dce5a6741e138f69e9b4ee1f3875763b5a53c5 ALSA-2024:2968 Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security and bug fix update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_9_default fence-agents-azure-arm-4.2.1-129.el8.noarch.rpm 3ddff0c91dfd33733373dc8e9ff157f19db47f5d98d3f50558c5adeda8d5d464 fence-agents-gce-4.2.1-129.el8.noarch.rpm d4a1648ba4e62c910380cf694ec9136b21f17c7567690cdb009788c2e59228c5 ALSA-2024:3659 Copyright 2024 AlmaLinux OS 0 1 Important

booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time. Security Fix(es): * booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server (CVE-2024-3049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default booth-core-1.1-1.el8_10.1.s390x.rpm 22c781da2ce00b5a138c5b22be8b1a53d13a2683e08392d76a5f7059ffcfd131 booth-arbitrator-1.1-1.el8_10.1.noarch.rpm 2ed42efdc796a6e5db1ceefca4ffb07a8bac87521853a49c3bf5e94878171c8b booth-site-1.1-1.el8_10.1.noarch.rpm 9186b82d9917d72fb035cc9091e649749cda857a06ed91c147918cc90bec0e1a booth-test-1.1-1.el8_10.1.noarch.rpm a2b68433ada8ea79abd222e70084898349c77f54dc97321ba47c40a2317a4551 booth-1.1-1.el8_10.1.s390x.rpm a69158f089f7e2fa30984edce3c62cbad4b8875509878f3f24557c15dada8ad2 ALSA-2024:5338 Copyright 2024 AlmaLinux OS 0 1 Low

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-snmp-0.10.18-2.el8_10.1.s390x.rpm adca26c8559d6cf0b3bea303e9239e629017ede18fdbf3d6a6a5213898c3179a pcs-0.10.18-2.el8_10.1.s390x.rpm c4cf39805f0be84639578e91c2d086c7f4f2d5905e2fc1d2969a7fecb010ade0 ALSA-2024:6309 Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-gce-4.2.1-129.el8_10.4.noarch.rpm 32f6bd49eb54b3db836cd290c0da82d8cc0617d9978e6566e350d956ca31b108 fence-agents-aws-4.2.1-129.el8_10.4.noarch.rpm 56c91a605a010fe43299ecf2596888ed7d641c849997fd647ca3942cc420407d fence-agents-azure-arm-4.2.1-129.el8_10.4.noarch.rpm 96de6611355be0aa0614306425bea193d186862218db1c724dd693fe26aedc41 ALSA-2024:6311 Copyright 2024 AlmaLinux OS 0 1 Moderate

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-4.9.0-54.el8_10.4.s390x.rpm 49968c46d225ff231eb9d118bc88fa52f68e463b87e54960c4dafcf849278e4d resource-agents-paf-4.9.0-54.el8_10.4.s390x.rpm 70184f5bbb27787d22c0ebf2b099169b56b1f712badb4ca877d700ee96cb1c14 ALSA-2024:6670 Copyright 2024 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, >] and ]> (CVE-2024-41123) * rexml: DoS vulnerability in REXML (CVE-2024-41946) * rexml: DoS vulnerability in REXML (CVE-2024-43398) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-snmp-0.10.18-2.el8_10.2.alma.1.s390x.rpm 3553dc9ff9afd24ad8c65fa1d08f5a7045cac3457b9ddc940630f6a49265cf21 pcs-0.10.18-2.el8_10.2.alma.1.s390x.rpm 3818d8479e92065a8691d0cfb127ba968da1704b2242f594f1949b1e34a72da3 ALSA-2025:11047 Copyright 2025 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-snmp-0.10.18-2.el8_10.6.alma.1.s390x.rpm 1e23571332f829cf8517a346141e912a4ba4dc499840a277d59cb79189cd87d9 pcs-0.10.18-2.el8_10.6.alma.1.s390x.rpm 7dc086dabfa046670c5f51c04f1408d6287359486e4f8ab6cb86da08339a084e ALSA-2025:14999 Copyright 2025 AlmaLinux OS 0 1 Moderate

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-paf-4.9.0-54.el8_10.16.s390x.rpm 6cd3fa74431ef9363540a310ef730193c08717302f83666b916f675872847438 resource-agents-4.9.0-54.el8_10.16.s390x.rpm 91ff5a334202640902c4057c706bb0c7dcaf823b8db142ec95b9380ce0d219cc ALSA-2025:19719 Copyright 2025 AlmaLinux OS 0 1 Important

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-snmp-0.10.18-2.el8_10.7.alma.1.s390x.rpm 1aa57a85dd0831d3f185f0c120f023c24d2f7760adfb701b639b16f6a1bd2b79 pcs-0.10.18-2.el8_10.7.alma.1.s390x.rpm acae320ae5afa82ab4dd53647ab22edc935beda0ecbb87292f057086b0c74fdb ALSA-2025:2872 Copyright 2025 AlmaLinux OS 0 1 Important

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-0.10.18-2.el8_10.4.alma.1.s390x.rpm 100a06c4b1c2127fe99d8dfbf6a017badc806bf6893ea5cb0a0db2ccab9abb12 pcs-snmp-0.10.18-2.el8_10.4.alma.1.s390x.rpm cb95fd4b729a25f99ed552b56a848f8d38fbdc0fc77eab25f7be562e139a29a4 ALSA-2025:8254 Copyright 2025 AlmaLinux OS 0 1 Important

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727) * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-snmp-0.10.18-2.el8_10.5.alma.1.s390x.rpm 18c795ddfe0909a49d30f5b91430613d626899f2963e96a85d0e3dd40f0d6cf4 pcs-0.10.18-2.el8_10.5.alma.1.s390x.rpm 8ed29dd3fb6bfd2b7ee14af09ccbc24fa5bb0ad714301a79e6585652344349fa ALSA-2026:0930 Copyright 2026 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725) * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-0.10.18-2.el8_10.8.alma.1.s390x.rpm 05d33a3a4b3dc204c7486d69df9a49c783550ac98026db3ac5b4479c56c20588 pcs-snmp-0.10.18-2.el8_10.8.alma.1.s390x.rpm 29f0d562108c390fd06ed6e527e12990213215083d7f63f3ef4af8afc1c4d8db ALSA-2026:12176 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-gce-4.2.1-129.el8_10.25.noarch.rpm be513db6fdebbab74772197e16785f71a8cccbffdb2aa8a44005c805487f860e fence-agents-aws-4.2.1-129.el8_10.25.noarch.rpm ea01f2ced268ea06be9ca086b465349a0c8952357f15a7e14829670da9e209a6 ALSA-2026:1240 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-gce-4.2.1-129.el8_10.20.noarch.rpm 9f2d301e157213fe9852be7f1623254f1f18e81cccf8198ae0e005f0eb6d50b6 fence-agents-aws-4.2.1-129.el8_10.20.noarch.rpm a3f7ffa8d683f949e2a77ed2843efb02fcc9fc1a8c9a3360efb3ac033d0a044b ALSA-2026:1241 Copyright 2026 AlmaLinux OS 0 1 Important

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-4.9.0-54.el8_10.27.s390x.rpm 2519338098570d90827157ce0322df4406fa2a939cb6040d1bde7dda6be57a99 resource-agents-paf-4.9.0-54.el8_10.27.s390x.rpm e090d1bb8a50643c62a5405ca05da2a3d9bd1d841f20c7f9ab41500d7bad0fa6 ALSA-2026:13657 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default spausedd-3.1.8-1.el8_10.1.s390x.rpm 465b6f385b26b12e70016dc554e39cbeba472bf8d3a5bf6143e0124bb2174787 corosync-3.1.8-1.el8_10.1.s390x.rpm c752118f7a26e7d5292b8d13d0370070710fc1d2015abac62475e4a4ae1dd2ae corosynclib-devel-3.1.8-1.el8_10.1.s390x.rpm f6e1275e241528b797d2203a8bffbbcea4793b92735b8a13d5f1a42e0815c98d ALSA-2026:13902 Copyright 2026 AlmaLinux OS 0 1 Important

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-paf-4.9.0-54.el8_10.33.s390x.rpm 408d49a55d8a770849dac0347d886822c033c1353d93aa6e5f3a4d8883ff6eee resource-agents-4.9.0-54.el8_10.33.s390x.rpm fe80d65e7bf534e8c275b1a57b04c4f5baff0b205e4b56e2826bb2d6278758fc ALSA-2026:1904 Copyright 2026 AlmaLinux OS 0 1 Important

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-4.9.0-54.el8_10.28.s390x.rpm 6bcb7e686ec44b69cfb81dc138f880f4e3794f86ed5465fab898bef277ecc473 resource-agents-paf-4.9.0-54.el8_10.28.s390x.rpm ee81471fdcc47833f43212af0848129185f02cd7393060f9ed1068c0b4f31529 ALSA-2026:1906 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-aws-4.2.1-129.el8_10.21.noarch.rpm 22167e15c2afc4e2d256b3658aeba654f2bbd1af090838c5e1472234168090f7 fence-agents-gce-4.2.1-129.el8_10.21.noarch.rpm 90c8058ea41fc6cfa37798fb800f9b4bdbd0b6181b3b17967edeb3fce2c7cb9d ALSA-2026:39322 Copyright 2026 AlmaLinux OS 0 1 Important

pacemaker security update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default python3-pacemaker-2.1.7-5.6.el8_10.noarch.rpm 00407e31173f1e2233a3501bd96969e8c992b986c6ab400db6dd5987f5c00165 pacemaker-cli-2.1.7-5.6.el8_10.s390x.rpm 11ca7bffd41b5ccd2b5612016d3167998a84434cae7c2e6aecc8719bdda9f3e2 pacemaker-libs-devel-2.1.7-5.6.el8_10.s390x.rpm 37f6efad82df2d8f13fb87dcc2d38d60a4aaf79d90afd1e6012314b4b4568eab pacemaker-remote-2.1.7-5.6.el8_10.s390x.rpm 40dd7f67ccc5ff4cb667af8d1935da09d5be373b4881b383cda64197fd51bd23 pacemaker-2.1.7-5.6.el8_10.s390x.rpm 636fe84f4ff4fea7471c594c124f054d62f49d71bbfd61fa1a099c94b81056da pacemaker-nagios-plugins-metadata-2.1.7-5.6.el8_10.noarch.rpm 9c94ead9243c89a429c37a087700b44d382a4cde882d2c098d880896f51f927b pacemaker-doc-2.1.7-5.6.el8_10.noarch.rpm eab22ee24e527a60e61fb41753cc3309d4a162107f4df05181754c631ff2cb2d pacemaker-cts-2.1.7-5.6.el8_10.noarch.rpm fc6685eaa7b8fabcda08385452c19c48889fe1c09e25cc1c4691b89e3cc954c9 ALSA-2026:47126 Copyright 2026 AlmaLinux OS 0 1 Moderate

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-4.9.0-54.el8_10.36.alma.1.s390x.rpm 176a8f618dd71fcd09db2aba74c79be1b788131a2553a987d4ca13ca4d1be9eb resource-agents-paf-4.9.0-54.el8_10.36.alma.1.s390x.rpm 697fcd7613d7057e400eee6e6691ff4ae8ec78fc9faa1728d5cdfd7c81250621 ALSA-2026:47736 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-aws-4.2.1-129.el8_10.27.noarch.rpm 01a3e896b3a9ca6a07fff581ae09cd7c0314493ea080d70877e7299dfd463700 fence-agents-gce-4.2.1-129.el8_10.27.noarch.rpm 6c7cc982029fa53434bd0e7b14a969afb4e092ec74bbb16edfd1b6417e651757 ALSA-2026:49927 Copyright 2026 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-gce-4.2.1-129.el8_10.28.noarch.rpm 1058febc67c5dc13622bc1487f10c09e352d9bfb9bee88f24283c3ffc434faa3 fence-agents-aws-4.2.1-129.el8_10.28.noarch.rpm c893d64c04c0d735e6abf31556291094d5de3e0ef1e74e9847ba7b8c93b7288b ALSA-2026:53363 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default fence-agents-gce-4.2.1-129.el8_10.29.noarch.rpm b99eb34289f7715adf9660d245c52ad14ba0142554bd8a067f3226f79a03323b fence-agents-aws-4.2.1-129.el8_10.29.noarch.rpm c9b599faeb88253b8a007a81d1ebf5538ef53e5b044d7c1b6ff8a98d86671437 ALSA-2026:53364 Copyright 2026 AlmaLinux OS 0 1 Important

resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default resource-agents-4.9.0-54.el8_10.37.alma.1.s390x.rpm 40e8f10c275d7de9ea3111fc7df161b47e9410ad977486b18a6746118a16bc7f resource-agents-paf-4.9.0-54.el8_10.37.alma.1.s390x.rpm 94cf9dd53929e30c89084bf14d3b06fb2b4097a1fec3b806b1be359694615438 ALSA-2026:69277 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default corosynclib-devel-3.1.8-1.el8_10.2.s390x.rpm 6692647f3d7ca79d83b19b7916b4d499777b69b3c2165d17bcf4277882109274 corosync-3.1.8-1.el8_10.2.s390x.rpm 97ad5db664a6a5624bc924f5450b5331422a035eef27d7a9c0bbaf673cd33038 spausedd-3.1.8-1.el8_10.2.s390x.rpm daec12c80f8fdeb7020bc8a690ca899ce36e2bc4c61d59b37b01cdaa6939c744 ALSA-2026:8093 Copyright 2026 AlmaLinux OS 0 1 Moderate

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-0.10.18-2.el8_10.9.alma.1.s390x.rpm 31ac9e2568820c30e5ee644e1bad8b9750f9e1353e09b30438aed5757ea3864b pcs-snmp-0.10.18-2.el8_10.9.alma.1.s390x.rpm 8282ad8c8bb88196b4502a8c0b9e2b9dc49b47882c9b98cc9c115f2519cc1264 ALSA-2026:84798 Copyright 2026 AlmaLinux OS 0 1 Important

pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397) * python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-highavailability-rpms__8_10_default pcs-0.10.18-2.el8_10.10.alma.1.s390x.rpm 70e12d76e00d5a9ec975a68469af31f890f547cfb1d07c2aca2364198da1b90d pcs-snmp-0.10.18-2.el8_10.10.alma.1.s390x.rpm cb343c6b0db88f7bd07bd88772fcda1489db7ed5a58cae9e32af1517fda5ab7c