diff --git a/RHEL-142445-1-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch b/RHEL-142445-1-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch deleted file mode 100644 index 8bbe037..0000000 --- a/RHEL-142445-1-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch +++ /dev/null @@ -1,28 +0,0 @@ ---- a/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/codec/ber/decoder.py 2019-10-17 07:00:19.000000000 +0200 -+++ b/kubevirt/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/codec/ber/decoder.py 2026-01-27 10:43:12.757563432 +0100 -@@ -22,6 +22,10 @@ - - noValue = base.noValue - -+# Maximum number of continuation octets (high-bit set) allowed per OID arc. -+# 20 octets allows up to 140-bit integers, supporting UUID-based OIDs -+MAX_OID_ARC_CONTINUATION_OCTETS = 20 -+ - - class AbstractDecoder(object): - protoComponent = None -@@ -342,7 +346,14 @@ - # Construct subid from a number of octets - nextSubId = subId - subId = 0 -+ continuationOctetCount = 0 - while nextSubId >= 128: -+ continuationOctetCount += 1 -+ if continuationOctetCount > MAX_OID_ARC_CONTINUATION_OCTETS: -+ raise error.PyAsn1Error( -+ 'OID arc exceeds maximum continuation octets limit (%d) ' -+ 'at position %d' % (MAX_OID_ARC_CONTINUATION_OCTETS, index) -+ ) - subId = (subId << 7) + (nextSubId & 0x7F) - if index >= substrateLen: - raise error.SubstrateUnderrunError( diff --git a/RHEL-142445-2-google-fix-bundled-pyasn1-CVE-2026-23490.patch b/RHEL-142445-2-google-fix-bundled-pyasn1-CVE-2026-23490.patch deleted file mode 100644 index cb6adac..0000000 --- a/RHEL-142445-2-google-fix-bundled-pyasn1-CVE-2026-23490.patch +++ /dev/null @@ -1,28 +0,0 @@ ---- a/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/codec/ber/decoder.py 2019-10-17 07:00:19.000000000 +0200 -+++ b/google/lib/python#PYTHON3_VERSION#/site-packages/pyasn1/codec/ber/decoder.py 2026-01-27 10:43:12.757563432 +0100 -@@ -22,6 +22,10 @@ - - noValue = base.noValue - -+# Maximum number of continuation octets (high-bit set) allowed per OID arc. -+# 20 octets allows up to 140-bit integers, supporting UUID-based OIDs -+MAX_OID_ARC_CONTINUATION_OCTETS = 20 -+ - - class AbstractDecoder(object): - protoComponent = None -@@ -342,7 +346,14 @@ - # Construct subid from a number of octets - nextSubId = subId - subId = 0 -+ continuationOctetCount = 0 - while nextSubId >= 128: -+ continuationOctetCount += 1 -+ if continuationOctetCount > MAX_OID_ARC_CONTINUATION_OCTETS: -+ raise error.PyAsn1Error( -+ 'OID arc exceeds maximum continuation octets limit (%d) ' -+ 'at position %d' % (MAX_OID_ARC_CONTINUATION_OCTETS, index) -+ ) - subId = (subId << 7) + (nextSubId & 0x7F) - if index >= substrateLen: - raise error.SubstrateUnderrunError( diff --git a/fence-agents.spec b/fence-agents.spec index 9d2a501..3948860 100644 --- a/fence-agents.spec +++ b/fence-agents.spec @@ -13,7 +13,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.16.0 -Release: 23%{?alphatag:.%{alphatag}}%{?dist} +Release: 24%{?alphatag:.%{alphatag}}%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -1220,7 +1220,7 @@ are located on corosync cluster nodes. %endif %changelog -* Wed Apr 29 2026 Oyvind Albrigtsen - 4.16.0-23 +* Wed Apr 29 2026 Oyvind Albrigtsen - 4.16.0-24 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157188, RHEL-155669