rpms/fence-agents
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- bundled urllib3: fix CVE-2025-66471

Browse Source 
- bundled urllib3: fix CVE-2026-21441
  Resolves: RHEL-139799, RHEL-140796
This commit is contained in:
Oyvind Albrigtsen 2026-01-20 12:51:38 +01:00
parent 745db066fb
commit 7e31dc04f6
2 changed files with 134 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

152
RHEL-139799-fix-bundled-urllib3-CVE-2025-66471.patch
View File

@ -1,5 +1,5 @@
--- a/aws/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200
+++ b/aws/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100
--- a/aws/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100
+++ b/aws/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100
@@ -23,6 +23,7 @@
from .exceptions import (
BodyNotHttplibCompatible,
@ -187,7 +187,7 @@
def flush(self):
if hasattr(self._obj, "flush"):
@@ -141,10 +228,35 @@
@@ -151,10 +238,35 @@
def flush(self):
return self._decoders[0].flush()
@ -227,7 +227,35 @@
def _get_decoder(mode):
@@ -624,7 +736,10 @@
@@ -405,16 +517,25 @@
if brotli is not None:
DECODER_ERROR_CLASSES += (brotli.error,)
- def _decode(self, data, decode_content, flush_decoder):
+ def _decode(
+ self,
+ data: bytes,
+ decode_content: bool,
+ flush_decoder: bool,
+ max_length: int = None,
+ ) -> bytes:
"""
Decode the data passed in and potentially flush the decoder.
"""
if not decode_content:
return data
+ if max_length is None or flush_decoder:
+ max_length = -1
+
try:
if self._decoder:
- data = self._decoder.decompress(data)
+ data = self._decoder.decompress(data, max_length=max_length)
except self.DECODER_ERROR_CLASSES as e:
content_encoding = self.headers.get("content-encoding", "").lower()
raise DecodeError(
@@ -634,7 +755,10 @@
for line in self.read_chunked(amt, decode_content=decode_content):
yield line
else:
@ -239,7 +267,7 @@
data = self.read(amt=amt, decode_content=decode_content)
if data:
@@ -830,7 +945,10 @@
@@ -840,7 +964,10 @@
break
chunk = self._handle_chunk(amt)
decoded = self._decode(
@ -252,8 +280,8 @@
if decoded:
yield decoded
--- a/azure/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200
+++ b/azure/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100
--- a/azure/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100
+++ b/azure/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100
@@ -23,6 +23,7 @@
from .exceptions import (
BodyNotHttplibCompatible,
@ -441,7 +469,7 @@
def flush(self):
if hasattr(self._obj, "flush"):
@@ -141,10 +228,35 @@
@@ -151,10 +238,35 @@
def flush(self):
return self._decoders[0].flush()
@ -481,7 +509,35 @@
def _get_decoder(mode):
@@ -624,7 +736,10 @@
@@ -405,16 +517,25 @@
if brotli is not None:
DECODER_ERROR_CLASSES += (brotli.error,)
- def _decode(self, data, decode_content, flush_decoder):
+ def _decode(
+ self,
+ data: bytes,
+ decode_content: bool,
+ flush_decoder: bool,
+ max_length: int = None,
+ ) -> bytes:
"""
Decode the data passed in and potentially flush the decoder.
"""
if not decode_content:
return data
+ if max_length is None or flush_decoder:
+ max_length = -1
+
try:
if self._decoder:
- data = self._decoder.decompress(data)
+ data = self._decoder.decompress(data, max_length=max_length)
except self.DECODER_ERROR_CLASSES as e:
content_encoding = self.headers.get("content-encoding", "").lower()
raise DecodeError(
@@ -634,7 +755,10 @@
for line in self.read_chunked(amt, decode_content=decode_content):
yield line
else:
@ -493,7 +549,7 @@
data = self.read(amt=amt, decode_content=decode_content)
if data:
@@ -830,7 +945,10 @@
@@ -840,7 +964,10 @@
break
chunk = self._handle_chunk(amt)
decoded = self._decode(
@ -506,8 +562,8 @@
if decoded:
yield decoded
--- a/google/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200
+++ b/google/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100
--- a/google/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100
+++ b/google/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100
@@ -23,6 +23,7 @@
from .exceptions import (
BodyNotHttplibCompatible,
@ -695,7 +751,7 @@
def flush(self):
if hasattr(self._obj, "flush"):
@@ -141,10 +228,35 @@
@@ -151,10 +238,35 @@
def flush(self):
return self._decoders[0].flush()
@ -735,7 +791,35 @@
def _get_decoder(mode):
@@ -624,7 +736,10 @@
@@ -405,16 +517,25 @@
if brotli is not None:
DECODER_ERROR_CLASSES += (brotli.error,)
- def _decode(self, data, decode_content, flush_decoder):
+ def _decode(
+ self,
+ data: bytes,
+ decode_content: bool,
+ flush_decoder: bool,
+ max_length: int = None,
+ ) -> bytes:
"""
Decode the data passed in and potentially flush the decoder.
"""
if not decode_content:
return data
+ if max_length is None or flush_decoder:
+ max_length = -1
+
try:
if self._decoder:
- data = self._decoder.decompress(data)
+ data = self._decoder.decompress(data, max_length=max_length)
except self.DECODER_ERROR_CLASSES as e:
content_encoding = self.headers.get("content-encoding", "").lower()
raise DecodeError(
@@ -634,7 +755,10 @@
for line in self.read_chunked(amt, decode_content=decode_content):
yield line
else:
@ -747,7 +831,7 @@
data = self.read(amt=amt, decode_content=decode_content)
if data:
@@ -830,7 +945,10 @@
@@ -840,7 +964,10 @@
break
chunk = self._handle_chunk(amt)
decoded = self._decode(
@ -760,8 +844,8 @@
if decoded:
yield decoded
--- a/kubevirt/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200
+++ b/kubevirt/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100
--- a/kubevirt/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100
+++ b/kubevirt/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100
@@ -23,6 +23,7 @@
from .exceptions import (
BodyNotHttplibCompatible,
@ -949,7 +1033,7 @@
def flush(self):
if hasattr(self._obj, "flush"):
@@ -141,10 +228,35 @@
@@ -151,10 +238,35 @@
def flush(self):
return self._decoders[0].flush()
@ -989,7 +1073,35 @@
def _get_decoder(mode):
@@ -624,7 +736,10 @@
@@ -405,16 +517,25 @@
if brotli is not None:
DECODER_ERROR_CLASSES += (brotli.error,)
- def _decode(self, data, decode_content, flush_decoder):
+ def _decode(
+ self,
+ data: bytes,
+ decode_content: bool,
+ flush_decoder: bool,
+ max_length: int = None,
+ ) -> bytes:
"""
Decode the data passed in and potentially flush the decoder.
"""
if not decode_content:
return data
+ if max_length is None or flush_decoder:
+ max_length = -1
+
try:
if self._decoder:
- data = self._decoder.decompress(data)
+ data = self._decoder.decompress(data, max_length=max_length)
except self.DECODER_ERROR_CLASSES as e:
content_encoding = self.headers.get("content-encoding", "").lower()
raise DecodeError(
@@ -634,7 +755,10 @@
for line in self.read_chunked(amt, decode_content=decode_content):
yield line
else:
@ -1001,7 +1113,7 @@
data = self.read(amt=amt, decode_content=decode_content)
if data:
@@ -830,7 +945,10 @@
@@ -840,7 +964,10 @@
break
chunk = self._handle_chunk(amt)
decoded = self._decode(

4
fence-agents.spec
View File

@ -57,7 +57,7 @@
Name: fence-agents
Summary: Set of unified programs capable of host isolation ("fencing")
Version: 4.10.0
Release: 104%{?alphatag:.%{alphatag}}%{?dist}
Release: 105%{?alphatag:.%{alphatag}}%{?dist}
License: GPLv2+ and LGPLv2+
URL: https://github.com/ClusterLabs/fence-agents
Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@ -1580,7 +1580,7 @@ are located on corosync cluster nodes.
%endif
%changelog
* Fri Jan 16 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-104
* Tue Jan 20 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-105
- bundled urllib3: fix CVE-2025-66471
- bundled urllib3: fix CVE-2026-21441
Resolves: RHEL-139799, RHEL-140796