From 56517ceff9bba3d83010a0087db6e83d1214734c Mon Sep 17 00:00:00 2001 From: Oyvind Albrigtsen Date: Mon, 8 Jun 2026 14:33:52 +0200 Subject: [PATCH] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182312 --- fence-agents.spec | 14 +++++++++----- sources | 4 ++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/fence-agents.spec b/fence-agents.spec index 921da6c..32b9d1d 100644 --- a/fence-agents.spec +++ b/fence-agents.spec @@ -13,7 +13,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.16.0 -Release: 26%{?alphatag:.%{alphatag}}%{?dist} +Release: 27%{?alphatag:.%{alphatag}}%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -54,7 +54,7 @@ Source1302: azure_mgmt_core-1.5.0.tar.gz Source1303: azure_mgmt_compute-34.0.0.tar.gz Source1304: azure_mgmt_network-28.1.0.tar.gz Source1305: azure_identity-1.19.0.tar.gz -Source1306: msal-1.31.1.tar.gz +Source1306: msal-1.37.0.tar.gz Source1307: msal_extensions-1.2.0.tar.gz Source1308: msrest-0.7.1.zip Source1309: msrestazure-0.6.4.post1.tar.gz @@ -62,7 +62,7 @@ Source1310: adal-1.2.7.tar.gz Source1311: certifi-2025.1.31.tar.gz Source1312: isodate-0.6.1.tar.gz Source1313: portalocker-2.10.1.tar.gz -Source1314: pyjwt-2.12.1.tar.gz +Source1314: pyjwt-2.13.0.tar.gz ## azure buildreq Source1315: setuptools-82.0.1.tar.gz # google @@ -440,7 +440,7 @@ Provides: bundled(python3-azure-mgmt-core) = 1.5.0 Provides: bundled(python3-azure-mgmt-compute) = 34.0.0 Provides: bundled(python3-azure-mgmt-network) = 28.1.0 Provides: bundled(python3-azure-identity) = 1.19.0 -Provides: bundled(python3-msal) = 1.31.1 +Provides: bundled(python3-msal) = 1.37.0 Provides: bundled(python3-msal-extensions) = 1.2.0 Provides: bundled(python3-msrest) = 0.7.1 Provides: bundled(python3-msrestazure) = 0.6.4.post1 @@ -448,7 +448,7 @@ Provides: bundled(python3-adal) = 1.2.7 Provides: bundled(python3-certifi) = 2025.1.31 Provides: bundled(python3-isodate) = 0.6.1 Provides: bundled(python3-portalocker) = 2.10.1 -Provides: bundled(python3-PyJWT) = 2.12.1 +Provides: bundled(python3-PyJWT) = 2.13.0 # google Provides: bundled(python3-google-api-python-client) = 1.12.8 Provides: bundled(python3-chardet) = 3.0.4 @@ -1224,6 +1224,10 @@ are located on corosync cluster nodes. %endif %changelog +* Mon Jun 8 2026 Oyvind Albrigtsen - 4.16.0-27 +- bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 + Resolves: RHEL-182312 + * Thu May 21 2026 Oyvind Albrigtsen - 4.16.0-26 - fence_kubevirt: report Succeeded and Failed as OFF Resolves: RHEL-81658 diff --git a/sources b/sources index 471eed1..70963cd 100644 --- a/sources +++ b/sources @@ -21,7 +21,7 @@ SHA512 (azure_mgmt_core-1.5.0.tar.gz) = ac88496015552ee473ebf8c7fe312bc7e79f10b3 SHA512 (azure_mgmt_compute-34.0.0.tar.gz) = 038ccac0792000778386769f81b908e35865ce20fc29d9d95e1ee774442d31b14162cdc7fed8dfcf4b7ef592a15d302968eca63ccc4363da3404e2ad53756254 SHA512 (azure_mgmt_network-28.1.0.tar.gz) = 43acf01c26efbb40a877feafeba659f27a4e903b3d2bbc01dcbf3e880d1ab4d9cca551b8ffb46ea939c3630221b6881f854213cfce7bcd5194b7593c506a7f59 SHA512 (azure_identity-1.19.0.tar.gz) = a0df8139b82cfb4f1887c340d8637f80575088e699106285ceca1211b884bc7154f237b279e9b086740a3fb9cc98f714613ab7ae98cf6eff08a48b32691c7de8 -SHA512 (msal-1.31.1.tar.gz) = 2d52681bf2229d9a87c195c777e90b4a1b567355ceba91a93220483bbea6ab108bfb934c70b3a60080c7cc3ecd4a07cae39ece3891c38e3c4cff77560875fee3 +SHA512 (msal-1.37.0.tar.gz) = 49778ca29b5f43304994a2dd13da399154efd3277df0acd6c7e589dc59b6cec1ff06284530a40efcfc8d468c53c1771bb03c42aebac8d6aaaf7ede8ec3af83a4 SHA512 (msal_extensions-1.2.0.tar.gz) = 8a56049bfb0c8237fe81f6d39c3368bb1c79ee9fcb211382f8b407ba89cea4f9405a2a4e54ef7f817b2d59091a036440009c2c5858e44da5cf790c1a97fef17e SHA512 (msrest-0.7.1.zip) = 430e982adf89c79356e59182587c62ecb935e983f2e339738b54c48d0cd3cfa66ab48aad52d342b3efe5938d5e02693f24d603a4d637e3e5818bac6d03cc19db SHA512 (msrestazure-0.6.4.post1.tar.gz) = 8fc4eba2520cecae612e9f1ab279662a1b531c73da3ee9af5abf59bc478b4edbf7ce0ea17d4491ff498d17269c31a82a9327eea4d1f1c704a4a7f434ef284acb @@ -29,7 +29,7 @@ SHA512 (adal-1.2.7.tar.gz) = b46dd3ebb72123e9c2d2eb75eae17b1175f09908b4443013125 SHA512 (certifi-2025.1.31.tar.gz) = 0923260200cb191ca10e9cfc7114a399f0dc87c7acbb833f950abaa6d4876805abe12838194809689f92424dd65e6e79f955f114b0acb00f8bd28e04a97ef555 SHA512 (isodate-0.6.1.tar.gz) = 437e420ec7ee68dedded825f30d3289eeb0da526208443e5a8e50fe70f12309515e1285b21132d26e6d4c1683f90dfa1d401582042b5e4381fe7ab0e34af26b6 SHA512 (portalocker-2.10.1.tar.gz) = 417d2b59c3cde6968b583d3e86153b85048354c9eb02fbd329a4d79b17abb47f3a07fe88af6b290d50111bb8534c8b2997633a93914e602c9312d4395af7407c -SHA512 (pyjwt-2.12.1.tar.gz) = ad1e925b9aa39017bd83863233b39de06a919daed664d5835e58def47f6fb4435fab057a37a5fa8a7543f691f5fc9f82e6d879ef0ad60960f982a214b305078a +SHA512 (pyjwt-2.13.0.tar.gz) = e12fcc5171e48ef74f4384287c05d94367b7add4844066b650abd6c82534e557959f59ffce9bd6d4dc6970b99b7357be5bb652d0546937b3a64dfd329b63b561 SHA512 (setuptools-82.0.1.tar.gz) = 5d70e9efd818245fb8119a4eed64d776078469ed884facc188f141ea491efd9fde5c10c928d3236ea5e2e431b16616f18ed14870b867f95e6320251707332395 SHA512 (google-api-python-client-1.12.8.tar.gz) = e6aafb165d12c0f38b26326320f6f4dfebd4eef8401cda0a915fbf04bfff91e39cc4572979324808a71b863711b4fab2a9b397da9f933fb12867e8453e17354f SHA512 (chardet-3.0.4.tar.gz) = 61a03b23447a2bfe52ceed4dd1b9afdb5784da1933a623776883ee9f297e341f633e27f0ce0230bd5fdc5fdb5382105ab42736a74a417ddeb9f83af57455dba5