From 7e31dc04f6acee88055835258c5c08cf57bfd913 Mon Sep 17 00:00:00 2001 From: Oyvind Albrigtsen Date: Tue, 20 Jan 2026 12:51:38 +0100 Subject: [PATCH] - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139799, RHEL-140796 --- ...9-fix-bundled-urllib3-CVE-2025-66471.patch | 152 +++++++++++++++--- fence-agents.spec | 4 +- 2 files changed, 134 insertions(+), 22 deletions(-) diff --git a/RHEL-139799-fix-bundled-urllib3-CVE-2025-66471.patch b/RHEL-139799-fix-bundled-urllib3-CVE-2025-66471.patch index de1f075..031c2ef 100644 --- a/RHEL-139799-fix-bundled-urllib3-CVE-2025-66471.patch +++ b/RHEL-139799-fix-bundled-urllib3-CVE-2025-66471.patch @@ -1,5 +1,5 @@ ---- a/aws/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/aws/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 +--- a/aws/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100 ++++ b/aws/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -187,7 +187,7 @@ def flush(self): if hasattr(self._obj, "flush"): -@@ -141,10 +228,35 @@ +@@ -151,10 +238,35 @@ def flush(self): return self._decoders[0].flush() @@ -227,7 +227,35 @@ def _get_decoder(mode): -@@ -624,7 +736,10 @@ +@@ -405,16 +517,25 @@ + if brotli is not None: + DECODER_ERROR_CLASSES += (brotli.error,) + +- def _decode(self, data, decode_content, flush_decoder): ++ def _decode( ++ self, ++ data: bytes, ++ decode_content: bool, ++ flush_decoder: bool, ++ max_length: int = None, ++ ) -> bytes: + """ + Decode the data passed in and potentially flush the decoder. + """ + if not decode_content: + return data + ++ if max_length is None or flush_decoder: ++ max_length = -1 ++ + try: + if self._decoder: +- data = self._decoder.decompress(data) ++ data = self._decoder.decompress(data, max_length=max_length) + except self.DECODER_ERROR_CLASSES as e: + content_encoding = self.headers.get("content-encoding", "").lower() + raise DecodeError( +@@ -634,7 +755,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: @@ -239,7 +267,7 @@ data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +945,10 @@ +@@ -840,7 +964,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( @@ -252,8 +280,8 @@ if decoded: yield decoded ---- a/azure/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/azure/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 +--- a/azure/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100 ++++ b/azure/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -441,7 +469,7 @@ def flush(self): if hasattr(self._obj, "flush"): -@@ -141,10 +228,35 @@ +@@ -151,10 +238,35 @@ def flush(self): return self._decoders[0].flush() @@ -481,7 +509,35 @@ def _get_decoder(mode): -@@ -624,7 +736,10 @@ +@@ -405,16 +517,25 @@ + if brotli is not None: + DECODER_ERROR_CLASSES += (brotli.error,) + +- def _decode(self, data, decode_content, flush_decoder): ++ def _decode( ++ self, ++ data: bytes, ++ decode_content: bool, ++ flush_decoder: bool, ++ max_length: int = None, ++ ) -> bytes: + """ + Decode the data passed in and potentially flush the decoder. + """ + if not decode_content: + return data + ++ if max_length is None or flush_decoder: ++ max_length = -1 ++ + try: + if self._decoder: +- data = self._decoder.decompress(data) ++ data = self._decoder.decompress(data, max_length=max_length) + except self.DECODER_ERROR_CLASSES as e: + content_encoding = self.headers.get("content-encoding", "").lower() + raise DecodeError( +@@ -634,7 +755,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: @@ -493,7 +549,7 @@ data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +945,10 @@ +@@ -840,7 +964,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( @@ -506,8 +562,8 @@ if decoded: yield decoded ---- a/google/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/google/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 +--- a/google/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100 ++++ b/google/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -695,7 +751,7 @@ def flush(self): if hasattr(self._obj, "flush"): -@@ -141,10 +228,35 @@ +@@ -151,10 +238,35 @@ def flush(self): return self._decoders[0].flush() @@ -735,7 +791,35 @@ def _get_decoder(mode): -@@ -624,7 +736,10 @@ +@@ -405,16 +517,25 @@ + if brotli is not None: + DECODER_ERROR_CLASSES += (brotli.error,) + +- def _decode(self, data, decode_content, flush_decoder): ++ def _decode( ++ self, ++ data: bytes, ++ decode_content: bool, ++ flush_decoder: bool, ++ max_length: int = None, ++ ) -> bytes: + """ + Decode the data passed in and potentially flush the decoder. + """ + if not decode_content: + return data + ++ if max_length is None or flush_decoder: ++ max_length = -1 ++ + try: + if self._decoder: +- data = self._decoder.decompress(data) ++ data = self._decoder.decompress(data, max_length=max_length) + except self.DECODER_ERROR_CLASSES as e: + content_encoding = self.headers.get("content-encoding", "").lower() + raise DecodeError( +@@ -634,7 +755,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: @@ -747,7 +831,7 @@ data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +945,10 @@ +@@ -840,7 +964,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( @@ -760,8 +844,8 @@ if decoded: yield decoded ---- a/kubevirt/urllib3/response.py 2023-10-17 19:42:56.000000000 +0200 -+++ b/kubevirt/urllib3/response.py 2026-01-16 10:53:08.058702582 +0100 +--- a/kubevirt/urllib3/response.py 2026-01-20 10:46:57.006470161 +0100 ++++ b/kubevirt/urllib3/response.py 2026-01-20 10:55:44.090084896 +0100 @@ -23,6 +23,7 @@ from .exceptions import ( BodyNotHttplibCompatible, @@ -949,7 +1033,7 @@ def flush(self): if hasattr(self._obj, "flush"): -@@ -141,10 +228,35 @@ +@@ -151,10 +238,35 @@ def flush(self): return self._decoders[0].flush() @@ -989,7 +1073,35 @@ def _get_decoder(mode): -@@ -624,7 +736,10 @@ +@@ -405,16 +517,25 @@ + if brotli is not None: + DECODER_ERROR_CLASSES += (brotli.error,) + +- def _decode(self, data, decode_content, flush_decoder): ++ def _decode( ++ self, ++ data: bytes, ++ decode_content: bool, ++ flush_decoder: bool, ++ max_length: int = None, ++ ) -> bytes: + """ + Decode the data passed in and potentially flush the decoder. + """ + if not decode_content: + return data + ++ if max_length is None or flush_decoder: ++ max_length = -1 ++ + try: + if self._decoder: +- data = self._decoder.decompress(data) ++ data = self._decoder.decompress(data, max_length=max_length) + except self.DECODER_ERROR_CLASSES as e: + content_encoding = self.headers.get("content-encoding", "").lower() + raise DecodeError( +@@ -634,7 +755,10 @@ for line in self.read_chunked(amt, decode_content=decode_content): yield line else: @@ -1001,7 +1113,7 @@ data = self.read(amt=amt, decode_content=decode_content) if data: -@@ -830,7 +945,10 @@ +@@ -840,7 +964,10 @@ break chunk = self._handle_chunk(amt) decoded = self._decode( diff --git a/fence-agents.spec b/fence-agents.spec index 0be19d3..3d3e5ba 100644 --- a/fence-agents.spec +++ b/fence-agents.spec @@ -57,7 +57,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.10.0 -Release: 104%{?alphatag:.%{alphatag}}%{?dist} +Release: 105%{?alphatag:.%{alphatag}}%{?dist} License: GPLv2+ and LGPLv2+ URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -1580,7 +1580,7 @@ are located on corosync cluster nodes. %endif %changelog -* Fri Jan 16 2026 Oyvind Albrigtsen - 4.10.0-104 +* Tue Jan 20 2026 Oyvind Albrigtsen - 4.10.0-105 - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139799, RHEL-140796