import OL fence-agents-4.10.0-76.el9_5.6
This commit is contained in:
parent
fc82836a77
commit
961e4cc6df
@ -1,4 +1,3 @@
|
||||
a9db54d91b53f76f546afa1414dd015c0574ebeb SOURCES/Jinja2-3.1.3.tar.gz
|
||||
e1b766b2b1601fde67b3b19ed2f13b9746bb1cca SOURCES/MarkupSafe-2.0.1.tar.gz
|
||||
e1fb5dc6f95a85e7d1f93c6701b331201e8b5479 SOURCES/PyJWT-2.1.0-py3-none-any.whl
|
||||
53fc16036940089ceadd4127381e40fd6106a7ed SOURCES/PyYAML-5.1.tar.gz
|
||||
@ -43,6 +42,7 @@ dc553afa7a3f23b92ee9ecd27d0b15153c0e9f75 SOURCES/googleapis_common_protos-1.53.0
|
||||
999b6718b4d789d8ca0d2ddf7c07826154291825 SOURCES/idna-2.10-py2.py3-none-any.whl
|
||||
08c0449533fc94462f78652dea209099754d9ee4 SOURCES/idna-3.3.tar.gz
|
||||
240cc4206740fafacb74bbf0d0c4ff70e41c8a85 SOURCES/isodate-0.6.0-py2.py3-none-any.whl
|
||||
41fdca818f95b8f0d35298eaab42f4e714dedf19 SOURCES/jinja2-3.1.6.tar.gz
|
||||
68904717c48e95adb47d815178fff8d80f39b2ab SOURCES/jmespath-0.7.1-py2.py3-none-any.whl
|
||||
d06a9547b1a87e9c51b0a7c708189d993f2e3d89 SOURCES/kubernetes-12.0.1.tar.gz
|
||||
ecd73099139d222059443ad19dfeee3f715e1ab0 SOURCES/msal-1.18.0.tar.gz
|
||||
|
||||
2
.gitignore
vendored
2
.gitignore
vendored
@ -1,4 +1,3 @@
|
||||
SOURCES/Jinja2-3.1.3.tar.gz
|
||||
SOURCES/MarkupSafe-2.0.1.tar.gz
|
||||
SOURCES/PyJWT-2.1.0-py3-none-any.whl
|
||||
SOURCES/PyYAML-5.1.tar.gz
|
||||
@ -43,6 +42,7 @@ SOURCES/httplib2-0.19.1-py3-none-any.whl
|
||||
SOURCES/idna-2.10-py2.py3-none-any.whl
|
||||
SOURCES/idna-3.3.tar.gz
|
||||
SOURCES/isodate-0.6.0-py2.py3-none-any.whl
|
||||
SOURCES/jinja2-3.1.6.tar.gz
|
||||
SOURCES/jmespath-0.7.1-py2.py3-none-any.whl
|
||||
SOURCES/kubernetes-12.0.1.tar.gz
|
||||
SOURCES/msal-1.18.0.tar.gz
|
||||
|
||||
@ -1,65 +0,0 @@
|
||||
From d655030770081e2dfe46f90e27620472a502289d Mon Sep 17 00:00:00 2001
|
||||
From: David Lord <davidism@gmail.com>
|
||||
Date: Thu, 2 May 2024 09:14:00 -0700
|
||||
Subject: [PATCH] disallow invalid characters in keys to xmlattr filter
|
||||
|
||||
---
|
||||
CHANGES.rst | 6 ++++++
|
||||
src/jinja2/filters.py | 22 +++++++++++++++++-----
|
||||
tests/test_filters.py | 11 ++++++-----
|
||||
3 files changed, 29 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/kubevirt/jinja2/filters.py b/kubevirt/jinja2/filters.py
|
||||
index 4cf3c11fb..acd11976e 100644
|
||||
--- a/kubevirt/jinja2/filters.py
|
||||
+++ b/kubevirt/jinja2/filters.py
|
||||
@@ -250,7 +250,9 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K
|
||||
yield from value.items()
|
||||
|
||||
|
||||
-_space_re = re.compile(r"\s", flags=re.ASCII)
|
||||
+# Check for characters that would move the parser state from key to value.
|
||||
+# https://html.spec.whatwg.org/#attribute-name-state
|
||||
+_attr_key_re = re.compile(r"[\s/>=]", flags=re.ASCII)
|
||||
|
||||
|
||||
@pass_eval_context
|
||||
@@ -259,8 +261,14 @@ def do_xmlattr(
|
||||
) -> str:
|
||||
"""Create an SGML/XML attribute string based on the items in a dict.
|
||||
|
||||
- If any key contains a space, this fails with a ``ValueError``. Values that
|
||||
- are neither ``none`` nor ``undefined`` are automatically escaped.
|
||||
+ **Values** that are neither ``none`` nor ``undefined`` are automatically
|
||||
+ escaped, safely allowing untrusted user input.
|
||||
+
|
||||
+ User input should not be used as **keys** to this filter. If any key
|
||||
+ contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals
|
||||
+ sign, this fails with a ``ValueError``. Regardless of this, user input
|
||||
+ should never be used as keys to this filter, or must be separately validated
|
||||
+ first.
|
||||
|
||||
.. sourcecode:: html+jinja
|
||||
|
||||
@@ -280,6 +288,10 @@ def do_xmlattr(
|
||||
As you can see it automatically prepends a space in front of the item
|
||||
if the filter returned something unless the second parameter is false.
|
||||
|
||||
+ .. versionchanged:: 3.1.4
|
||||
+ Keys with ``/`` solidus, ``>`` greater-than sign, or ``=`` equals sign
|
||||
+ are not allowed.
|
||||
+
|
||||
.. versionchanged:: 3.1.3
|
||||
Keys with spaces are not allowed.
|
||||
"""
|
||||
@@ -289,8 +301,8 @@ def do_xmlattr(
|
||||
if value is None or isinstance(value, Undefined):
|
||||
continue
|
||||
|
||||
- if _space_re.search(key) is not None:
|
||||
- raise ValueError(f"Spaces are not allowed in attributes: '{key}'")
|
||||
+ if _attr_key_re.search(key) is not None:
|
||||
+ raise ValueError(f"Invalid character in attribute name: {key!r}")
|
||||
|
||||
items.append(f'{escape(key)}="{escape(value)}"')
|
||||
|
||||
@ -0,0 +1,40 @@
|
||||
From cb57f1c2ee734a40d01249305965ea4ecdf02039 Mon Sep 17 00:00:00 2001
|
||||
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
||||
Date: Thu, 5 Sep 2024 09:06:34 +0200
|
||||
Subject: [PATCH] fence_scsi: preempt clears all devices on the mpath device,
|
||||
so only run it for the first device
|
||||
|
||||
---
|
||||
agents/scsi/fence_scsi.py | 10 ++++++----
|
||||
1 file changed, 6 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/agents/scsi/fence_scsi.py b/agents/scsi/fence_scsi.py
|
||||
index a1598411c..12f7fb49b 100644
|
||||
--- a/agents/scsi/fence_scsi.py
|
||||
+++ b/agents/scsi/fence_scsi.py
|
||||
@@ -131,11 +131,13 @@ def reset_dev(options, dev):
|
||||
return run_cmd(options, options["--sg_turs-path"] + " " + dev)["rc"]
|
||||
|
||||
|
||||
-def register_dev(options, dev, key):
|
||||
+def register_dev(options, dev, key, do_preempt=True):
|
||||
dev = os.path.realpath(dev)
|
||||
if re.search(r"^dm", dev[5:]):
|
||||
- for slave in get_mpath_slaves(dev):
|
||||
- register_dev(options, slave, key)
|
||||
+ devices = get_mpath_slaves(dev)
|
||||
+ register_dev(options, devices[0], key)
|
||||
+ for device in devices[1:]:
|
||||
+ register_dev(options, device, key, False)
|
||||
return True
|
||||
|
||||
# Check if any registration exists for the key already. We track this in
|
||||
@@ -153,7 +155,7 @@ def register_dev(options, dev, key):
|
||||
# If key matches, make sure it matches with the connection that
|
||||
# exists right now. To do this, we can issue a preempt with same key
|
||||
# which should replace the old invalid entries from the target.
|
||||
- if not preempt(options, key, dev, key):
|
||||
+ if do_preempt and not preempt(options, key, dev, key):
|
||||
return False
|
||||
|
||||
# If there was no reservation, we need to issue another registration
|
||||
38
SOURCES/RHEL-83487-fence_ibm_vpc-refresh-bearer-token.patch
Normal file
38
SOURCES/RHEL-83487-fence_ibm_vpc-refresh-bearer-token.patch
Normal file
@ -0,0 +1,38 @@
|
||||
From 293b3961149f680ead9028e6719c405957abc6b7 Mon Sep 17 00:00:00 2001
|
||||
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
||||
Date: Thu, 13 Mar 2025 16:40:30 +0100
|
||||
Subject: [PATCH] fence_ibm_vpc: refresh bearer-token in connect() if token
|
||||
data is corrupt, and avoid edge-case of writing empty token file
|
||||
|
||||
---
|
||||
agents/ibm_vpc/fence_ibm_vpc.py | 10 ++++++++++
|
||||
1 file changed, 10 insertions(+)
|
||||
|
||||
diff --git a/agents/ibm_vpc/fence_ibm_vpc.py b/agents/ibm_vpc/fence_ibm_vpc.py
|
||||
index 035a3235a..efda5eed7 100755
|
||||
--- a/agents/ibm_vpc/fence_ibm_vpc.py
|
||||
+++ b/agents/ibm_vpc/fence_ibm_vpc.py
|
||||
@@ -105,6 +105,8 @@ def get_bearer_token(conn, options):
|
||||
except Exception as e:
|
||||
logging.error("Failed: Unable to authenticate: {}".format(e))
|
||||
fail(EC_LOGIN_DENIED)
|
||||
+ if len(token) < 1:
|
||||
+ fail(EC_LOGIN_DENIED)
|
||||
file_obj.write(token)
|
||||
finally:
|
||||
os.umask(oldumask)
|
||||
@@ -152,6 +154,14 @@ def connect(opt):
|
||||
# set auth token for later requests
|
||||
conn = set_bearer_token(conn, bearer_token)
|
||||
|
||||
+ try:
|
||||
+ command = "instances?version=2021-05-25&generation=2&limit=1"
|
||||
+ res = send_command(conn, opt, command)
|
||||
+ except Exception as e:
|
||||
+ logging.warning("Failed to login/connect. Updating bearer-token.")
|
||||
+ bearer_token = get_bearer_token(conn, opt)
|
||||
+ conn = set_bearer_token(conn, bearer_token)
|
||||
+
|
||||
return conn
|
||||
|
||||
def disconnect(conn):
|
||||
@ -37,8 +37,8 @@
|
||||
%global urllib3_version 1.26.18
|
||||
%global websocketclient websocket-client
|
||||
%global websocketclient_version 1.2.1
|
||||
%global jinja2 Jinja2
|
||||
%global jinja2_version 3.1.3
|
||||
%global jinja2 jinja2
|
||||
%global jinja2_version 3.1.6
|
||||
%global markupsafe MarkupSafe
|
||||
%global markupsafe_version 2.0.1
|
||||
%global stringutils string-utils
|
||||
@ -57,7 +57,7 @@
|
||||
Name: fence-agents
|
||||
Summary: Set of unified programs capable of host isolation ("fencing")
|
||||
Version: 4.10.0
|
||||
Release: 76%{?alphatag:.%{alphatag}}%{?dist}
|
||||
Release: 76%{?alphatag:.%{alphatag}}%{?dist}.6
|
||||
License: GPLv2+ and LGPLv2+
|
||||
URL: https://github.com/ClusterLabs/fence-agents
|
||||
Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
|
||||
@ -254,11 +254,12 @@ Patch54: RHEL-35263-fence_eps-add-fence_epsr2-for-ePowerSwitch-R2-and-newer.patc
|
||||
Patch55: RHEL-25256-fence_vmware_rest-detect-user-sufficient-rights.patch
|
||||
Patch56: RHEL-43235-fence_aws-1-list-add-instance-name-status.patch
|
||||
Patch57: RHEL-43235-fence_aws-2-log-error-for-unknown-states.patch
|
||||
Patch58: RHEL-59882-fence_scsi-only-preempt-once-for-mpath-devices.patch
|
||||
Patch59: RHEL-83487-fence_ibm_vpc-refresh-bearer-token.patch
|
||||
|
||||
### HA support libs/utils ###
|
||||
# all archs
|
||||
Patch1000: bz2217902-1-kubevirt-fix-bundled-dateutil-CVE-2007-4559.patch
|
||||
Patch1001: RHEL-35649-kubevirt-fix-bundled-jinja2-CVE-2024-34064.patch
|
||||
# cloud (x86_64 only)
|
||||
Patch2000: bz2217902-2-aws-awscli-azure-fix-bundled-dateutil-CVE-2007-4559.patch
|
||||
Patch2001: RHEL-43562-fix-bundled-urllib3-CVE-2024-37891.patch
|
||||
@ -433,6 +434,8 @@ BuildRequires: %{systemd_units}
|
||||
%patch -p1 -P 55
|
||||
%patch -p1 -P 56
|
||||
%patch -p1 -P 57
|
||||
%patch -p1 -P 58
|
||||
%patch -p1 -P 59
|
||||
|
||||
# prevent compilation of something that won't get used anyway
|
||||
sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac
|
||||
@ -489,7 +492,6 @@ rm -rf kubevirt/rsa*
|
||||
# regular patch doesnt work in build-section
|
||||
pushd support
|
||||
/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH1000}
|
||||
/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1001}
|
||||
|
||||
%ifarch x86_64
|
||||
/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH2000}
|
||||
@ -1530,6 +1532,24 @@ are located on corosync cluster nodes.
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Fri Mar 14 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.6
|
||||
- fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
|
||||
avoid edge-case of writing empty token file
|
||||
Resolves: RHEL-83487
|
||||
|
||||
* Tue Mar 11 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.5
|
||||
- bundled jinja2: fix CVE-2025-27516
|
||||
Resolves: RHEL-82712
|
||||
|
||||
* Thu Jan 9 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.4
|
||||
- bundled jinja2: fix CVE-2024-56201 and CVE-2024-56326
|
||||
Resolves: RHEL-72070, RHEL-72063
|
||||
|
||||
* Wed Sep 25 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.1
|
||||
- fence_scsi: preempt clears all devices on the mpath device, so only
|
||||
run it for the first device
|
||||
Resolves: RHEL-59882
|
||||
|
||||
* Tue Jul 23 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76
|
||||
- bundled setuptools: fix CVE-2024-6345
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user