diff --git a/RHEL-139756-fix-bundled-urllib3-CVE-2025-66471.patch b/RHEL-139756-fix-bundled-urllib3-CVE-2025-66471.patch index d919cb5..a8353fd 100644 --- a/RHEL-139756-fix-bundled-urllib3-CVE-2025-66471.patch +++ b/RHEL-139756-fix-bundled-urllib3-CVE-2025-66471.patch @@ -1,5 +1,5 @@ --- a/aws/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/aws/urllib3/response.py 2026-01-13 11:24:13.592292511 +0100 ++++ b/aws/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -227,20 +227,19 @@ def _get_decoder(mode): -@@ -624,7 +736,11 @@ +@@ -624,7 +736,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: - while not is_fp_closed(self._fp): + while ( + not is_fp_closed(self._fp) -+ or len(self._decoded_buffer) > 0 + or (self._decoder and self._decoder.has_unconsumed_tail) + ): data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +946,10 @@ +@@ -830,7 +945,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( @@ -254,7 +253,7 @@ yield decoded --- a/azure/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/azure/urllib3/response.py 2026-01-13 11:24:13.592292511 +0100 ++++ b/azure/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -482,20 +481,19 @@ def _get_decoder(mode): -@@ -624,7 +736,11 @@ +@@ -624,7 +736,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: - while not is_fp_closed(self._fp): + while ( + not is_fp_closed(self._fp) -+ or len(self._decoded_buffer) > 0 + or (self._decoder and self._decoder.has_unconsumed_tail) + ): data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +946,10 @@ +@@ -830,7 +945,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( @@ -509,7 +507,7 @@ yield decoded --- a/kubevirt/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/kubevirt/urllib3/response.py 2026-01-13 11:24:13.592292511 +0100 ++++ b/kubevirt/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -737,20 +735,19 @@ def _get_decoder(mode): -@@ -624,7 +736,11 @@ +@@ -624,7 +736,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: - while not is_fp_closed(self._fp): + while ( + not is_fp_closed(self._fp) -+ or len(self._decoded_buffer) > 0 + or (self._decoder and self._decoder.has_unconsumed_tail) + ): data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +946,10 @@ +@@ -830,7 +945,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( diff --git a/fence-agents.spec b/fence-agents.spec index 5e2af19..e2fc635 100644 --- a/fence-agents.spec +++ b/fence-agents.spec @@ -87,7 +87,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.2.1 -Release: 129%{?alphatag:.%{alphatag}}%{?dist}.18 +Release: 129%{?alphatag:.%{alphatag}}%{?dist}.19 License: GPLv2+ and LGPLv2+ Group: System Environment/Base URL: https://github.com/ClusterLabs/fence-agents @@ -1634,7 +1634,7 @@ Fence agent for IBM z/VM over IP. %endif %changelog -* Wed Jan 14 2026 Oyvind Albrigtsen - 4.2.1-129.18 +* Fri Jan 16 2026 Oyvind Albrigtsen - 4.2.1-129.19 - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139756, RHEL-140783