From 358874e409acf903aab1ec2bd8ab811c3d23b5f2 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 11 Aug 2026 21:37:14 -0400 Subject: [PATCH] import Oracle_OSS fence-agents-4.10.0-110.el9_8.6 --- ...rt-fix-bundled-pyasn1-CVE-2026-59886.patch | 52 +++++++++++++++++++ ...le-fix-bundled-pyasn1-CVE-2026-59886.patch | 52 +++++++++++++++++++ SPECS/fence-agents.spec | 10 +++- 3 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 SOURCES/RHEL-217934-1-kubevirt-fix-bundled-pyasn1-CVE-2026-59886.patch create mode 100644 SOURCES/RHEL-217934-2-google-fix-bundled-pyasn1-CVE-2026-59886.patch diff --git a/SOURCES/RHEL-217934-1-kubevirt-fix-bundled-pyasn1-CVE-2026-59886.patch b/SOURCES/RHEL-217934-1-kubevirt-fix-bundled-pyasn1-CVE-2026-59886.patch new file mode 100644 index 0000000..6ef8640 --- /dev/null +++ b/SOURCES/RHEL-217934-1-kubevirt-fix-bundled-pyasn1-CVE-2026-59886.patch @@ -0,0 +1,52 @@ +From e60c691cb91addb8fcefa2f537e85ede6fb1e886 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Wed, 8 Jul 2026 17:32:09 -0700 +Subject: [PATCH] Merge commit from fork + +--- + pyasn1/type/univ.py | 21 +++++++++---- + tests/codec/ber/test_decoder.py | 53 +++++++++++++++++++++++++++------ + tests/codec/cer/test_decoder.py | 10 +++++++ + tests/codec/der/test_decoder.py | 19 ++++++++++++ + tests/type/test_univ.py | 40 +++++++++++++++++++++++++ + 5 files changed, 129 insertions(+), 14 deletions(-) + +diff --git a/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py b/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py +index 9aff5e69..8b786dd9 100644 +--- a/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py ++++ b/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py +@@ -1362,7 +1362,7 @@ class Pi(Real): + def __normalizeBase10(value): + m, b, e = value + while m and m % 10 == 0: +- m /= 10 ++ m //= 10 + e += 1 + return m, b, e + +@@ -1490,10 +1490,21 @@ def __int__(self): + def __float__(self): + if self._value in self._inf: + return self._value +- else: +- return float( +- self._value[0] * pow(self._value[1], self._value[2]) +- ) ++ ++ mantissa, base, exponent = self._value ++ ++ if not mantissa: ++ return 0.0 ++ ++ if base == 2: ++ return math.ldexp(float(mantissa), exponent) ++ ++ # base is 10 (prettyIn() rejects everything else); refuse to ++ # materialize astronomically large integers via pow() ++ if exponent > sys.float_info.max_10_exp: ++ raise OverflowError('Real value too large to convert to float') ++ ++ return float(mantissa * pow(base, exponent)) + + def __abs__(self): + return self.clone(abs(float(self))) diff --git a/SOURCES/RHEL-217934-2-google-fix-bundled-pyasn1-CVE-2026-59886.patch b/SOURCES/RHEL-217934-2-google-fix-bundled-pyasn1-CVE-2026-59886.patch new file mode 100644 index 0000000..9dc20ab --- /dev/null +++ b/SOURCES/RHEL-217934-2-google-fix-bundled-pyasn1-CVE-2026-59886.patch @@ -0,0 +1,52 @@ +From e60c691cb91addb8fcefa2f537e85ede6fb1e886 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Wed, 8 Jul 2026 17:32:09 -0700 +Subject: [PATCH] Merge commit from fork + +--- + pyasn1/type/univ.py | 21 +++++++++---- + tests/codec/ber/test_decoder.py | 53 +++++++++++++++++++++++++++------ + tests/codec/cer/test_decoder.py | 10 +++++++ + tests/codec/der/test_decoder.py | 19 ++++++++++++ + tests/type/test_univ.py | 40 +++++++++++++++++++++++++ + 5 files changed, 129 insertions(+), 14 deletions(-) + +diff --git a/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py b/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py +index 9aff5e69..8b786dd9 100644 +--- a/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py ++++ b/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/type/univ.py +@@ -1362,7 +1362,7 @@ class Pi(Real): + def __normalizeBase10(value): + m, b, e = value + while m and m % 10 == 0: +- m /= 10 ++ m //= 10 + e += 1 + return m, b, e + +@@ -1490,10 +1490,21 @@ def __int__(self): + def __float__(self): + if self._value in self._inf: + return self._value +- else: +- return float( +- self._value[0] * pow(self._value[1], self._value[2]) +- ) ++ ++ mantissa, base, exponent = self._value ++ ++ if not mantissa: ++ return 0.0 ++ ++ if base == 2: ++ return math.ldexp(float(mantissa), exponent) ++ ++ # base is 10 (prettyIn() rejects everything else); refuse to ++ # materialize astronomically large integers via pow() ++ if exponent > sys.float_info.max_10_exp: ++ raise OverflowError('Real value too large to convert to float') ++ ++ return float(mantissa * pow(base, exponent)) + + def __abs__(self): + return self.clone(abs(float(self))) diff --git a/SPECS/fence-agents.spec b/SPECS/fence-agents.spec index d0c5767..56c10f7 100644 --- a/SPECS/fence-agents.spec +++ b/SPECS/fence-agents.spec @@ -47,7 +47,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.10.0 -Release: 110%{?alphatag:.%{alphatag}}%{?dist}.5 +Release: 110%{?alphatag:.%{alphatag}}%{?dist}.6 License: GPLv2+ and LGPLv2+ URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -226,10 +226,12 @@ Patch77: RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large Patch1000: bz2217902-1-kubevirt-fix-bundled-dateutil-CVE-2007-4559.patch Patch1001: RHEL-146344-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch Patch1002: RHEL-157202-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch +Patch1003: RHEL-217934-1-kubevirt-fix-bundled-pyasn1-CVE-2026-59886.patch # cloud (x86_64 only) Patch2000: bz2217902-2-aws-azure-fix-bundled-dateutil-CVE-2007-4559.patch Patch2001: RHEL-142460-fix-bundled-pyasn1-CVE-2026-23490.patch Patch2002: RHEL-157202-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch +Patch2003: RHEL-217934-2-google-fix-bundled-pyasn1-CVE-2026-59886.patch %global supportedagents amt_ws apc apc_snmp bladecenter brocade cisco_mds cisco_ucs compute drac5 eaton_snmp emerson eps evacuate hpblade ibmblade ibm_powervs ibm_vpc ifmib ilo ilo_moonshot ilo_mp ilo_ssh intelmodular ipdu ipmilan kdump kubevirt lpar mpath nutanix_ahv redfish rhevm rsa rsb sbd scsi vmware_rest vmware_soap wti %ifarch x86_64 @@ -492,11 +494,13 @@ pushd support /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH1000} /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1001} /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH1002} +/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1003} %ifarch x86_64 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH2000} /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH2001} /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH2002} +/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH2003} %endif popd @@ -1524,6 +1528,10 @@ are located on corosync cluster nodes. %endif %changelog +* Thu Jul 30 2026 Oyvind Albrigtsen - 4.10.0-110.6 +- bundled pyasn1: fix CVE-2026-59886 + Resolves: RHEL-217934 + * Wed Jul 15 2026 Oyvind Albrigtsen - 4.10.0-110.5 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193808