From c47e368942f37e550dd476b1142370464ea7d84f Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 25 Jun 2026 00:27:40 -0400 Subject: [PATCH] import Oracle_OSS fence-agents-4.10.0-110.el9_8.3 --- .fence-agents.metadata | 2 +- .gitignore | 2 +- ..._powervs-update-api-type-description.patch | 59 ++++++++++++++++ ...nce_gce-make-zone-parameter-optional.patch | 29 ++++++++ ...8926-2-fence_gce-fix-node-list-limit.patch | 43 ++++++++++++ ...0-fix-bundled-pyasn1-CVE-2026-23490.patch} | 0 ...-fence_ibm_vpc-fix-missing-statuses.patch} | 0 ...t-fix-bundled-pyasn1-CVE-2026-23490.patch} | 0 ...t-fix-bundled-pyasn1-CVE-2026-30922.patch} | 0 ...e-fix-bundled-pyasn1-CVE-2026-30922.patch} | 0 SPECS/fence-agents.spec | 69 ++++++++++++------- 11 files changed, 177 insertions(+), 27 deletions(-) create mode 100755 SOURCES/RHEL-114753-fence_ibm_powervs-update-api-type-description.patch create mode 100644 SOURCES/RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch create mode 100644 SOURCES/RHEL-128926-2-fence_gce-fix-node-list-limit.patch rename SOURCES/{RHEL-142459-fix-bundled-pyasn1-CVE-2026-23490.patch => RHEL-142460-fix-bundled-pyasn1-CVE-2026-23490.patch} (100%) rename SOURCES/{RHEL-145761-fence_ibm_vpc-fix-missing-statuses.patch => RHEL-145088-fence_ibm_vpc-fix-missing-statuses.patch} (100%) rename SOURCES/{RHEL-146351-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch => RHEL-146344-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch} (100%) rename SOURCES/{RHEL-157201-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch => RHEL-157202-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch} (100%) rename SOURCES/{RHEL-157201-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch => RHEL-157202-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch} (100%) diff --git a/.fence-agents.metadata b/.fence-agents.metadata index 2f9df42..f996a29 100644 --- a/.fence-agents.metadata +++ b/.fence-agents.metadata @@ -44,7 +44,7 @@ b21ec03f79d2a7ef4396d909f78130a92455c3c9 SOURCES/msrestazure-0.6.4.post1.tar.gz 0827aaa6fdc3dc4256e06fa1c3991fb4ed20a693 SOURCES/ptyprocess-0.7.0-py2.py3-none-any.whl e0fa19f8fda46a1fa2253477499b116b33f67175 SOURCES/pyasn1-0.4.8.tar.gz 43b89feb6864fe359aae89120627165219de313b SOURCES/pyasn1-modules-0.2.8.tar.gz -ec0a327d767f89b25f6797c50c60030103c3b821 SOURCES/pyjwt-2.12.1.tar.gz +38308c2bdb1618339212eb041206e14d1ce84640 SOURCES/pyjwt-2.13.0.tar.gz 770968018322c2b3fde684aebe964663c6f5d8c5 SOURCES/pyroute2-0.7.12.tar.gz 1dc2fa004aa6517f1620e55d8a7b8e68a9cf2a47 SOURCES/python-string-utils-1.0.0.tar.gz 3005ff67df93ee276fb8631e17c677df852254ad SOURCES/python_dateutil-2.8.1-py2.py3-none-any.whl diff --git a/.gitignore b/.gitignore index 7e29f5f..c60679e 100644 --- a/.gitignore +++ b/.gitignore @@ -44,7 +44,7 @@ SOURCES/protobuf-3.17.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl SOURCES/ptyprocess-0.7.0-py2.py3-none-any.whl SOURCES/pyasn1-0.4.8.tar.gz SOURCES/pyasn1-modules-0.2.8.tar.gz -SOURCES/pyjwt-2.12.1.tar.gz +SOURCES/pyjwt-2.13.0.tar.gz SOURCES/pyroute2-0.7.12.tar.gz SOURCES/python-string-utils-1.0.0.tar.gz SOURCES/python_dateutil-2.8.1-py2.py3-none-any.whl diff --git a/SOURCES/RHEL-114753-fence_ibm_powervs-update-api-type-description.patch b/SOURCES/RHEL-114753-fence_ibm_powervs-update-api-type-description.patch new file mode 100755 index 0000000..1a7788c --- /dev/null +++ b/SOURCES/RHEL-114753-fence_ibm_powervs-update-api-type-description.patch @@ -0,0 +1,59 @@ +From f0b9a79b4c17ba3d98cf4dad9e15391595535f90 Mon Sep 17 00:00:00 2001 +From: Oyvind Albrigtsen +Date: Mon, 25 Aug 2025 13:28:59 +0200 +Subject: [PATCH] fence_ibm_powervs: update description of api-type parameter + to show correct default value + +--- + agents/ibm_powervs/fence_ibm_powervs.py | 6 +++--- + tests/data/metadata/fence_ibm_powervs.xml | 8 ++++---- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/agents/ibm_powervs/fence_ibm_powervs.py b/agents/ibm_powervs/fence_ibm_powervs.py +index d408e8727..b4d3bdc32 100755 +--- a/agents/ibm_powervs/fence_ibm_powervs.py ++++ b/agents/ibm_powervs/fence_ibm_powervs.py +@@ -258,9 +258,10 @@ def define_new_opts(): + all_opt["api-type"] = { + "getopt" : ":", + "longopt" : "api-type", +- "help" : "--api-type=[public|private] API-type: 'public' (default) or 'private'", ++ "help" : "--api-type=[private|public] API-type: 'private' (default) or 'public'", + "required" : "0", +- "shortdesc" : "API-type (public|private)", ++ "shortdesc" : "API-type (private|public)", ++ "default" : "private", + "order" : 0 + } + all_opt["proxy"] = { +@@ -293,7 +294,6 @@ def main(): + all_opt["power_timeout"]["default"] = "120" + all_opt["power_wait"]["default"] = "15" + all_opt["stonith_status_sleep"]["default"] = "10" +- all_opt["api-type"]["default"] = "private" + all_opt["proxy"]["default"] = "" + + options = check_input(device_opt, process_input(device_opt)) +diff --git a/tests/data/metadata/fence_ibm_powervs.xml b/tests/data/metadata/fence_ibm_powervs.xml +index ec59e1b53..2298d60cd 100644 +--- a/tests/data/metadata/fence_ibm_powervs.xml ++++ b/tests/data/metadata/fence_ibm_powervs.xml +@@ -4,14 +4,14 @@ + https://www.ibm.com + + +- ++ + +- API-type (public|private) ++ API-type (private|public) + + +- ++ + +- API-type (public|private) ++ API-type (private|public) + + + diff --git a/SOURCES/RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch b/SOURCES/RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch new file mode 100644 index 0000000..07bae28 --- /dev/null +++ b/SOURCES/RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch @@ -0,0 +1,29 @@ +From 7c1dc4e3935b2246015bba7ba78be4ef7a200423 Mon Sep 17 00:00:00 2001 +From: kj1724 <78624900+kj1724@users.noreply.github.com> +Date: Wed, 18 May 2022 03:57:51 -0400 +Subject: [PATCH] fence_gce: Make zone optional for get_nodes_list (#487) + +--- + agents/gce/fence_gce.py | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/agents/gce/fence_gce.py b/agents/gce/fence_gce.py +index 63c7858f1..2bf4da5a1 100644 +--- a/agents/gce/fence_gce.py ++++ b/agents/gce/fence_gce.py +@@ -135,10 +135,12 @@ def translate_status(instance_status): + + def get_nodes_list(conn, options): + result = {} +- if "--zone" not in options: +- fail_fence_agent(options, "Failed: get_nodes_list: Please specify the --zone in the command") ++ plug = options["--plug"] if "--plug" in options else "" ++ zones = options["--zone"] if "--zone" in options else "" ++ if not zones: ++ zones = get_zone(conn, options, plug) if "--plugzonemap" not in options else options["--plugzonemap"][plug] + try: +- for zone in options["--zone"].split(","): ++ for zone in zones.split(","): + instanceList = retry_api_execute(options, conn.instances().list( + project=options["--project"], + zone=zone)) diff --git a/SOURCES/RHEL-128926-2-fence_gce-fix-node-list-limit.patch b/SOURCES/RHEL-128926-2-fence_gce-fix-node-list-limit.patch new file mode 100644 index 0000000..4910087 --- /dev/null +++ b/SOURCES/RHEL-128926-2-fence_gce-fix-node-list-limit.patch @@ -0,0 +1,43 @@ +From 07285aacbc2194c6a2dfc7dd62dda9a3308bc243 Mon Sep 17 00:00:00 2001 +From: dfellmeth-google +Date: Mon, 17 Nov 2025 04:44:49 -0500 +Subject: [PATCH] fence_gce: fix node list limit (#640) + +This change introduces filtering using the plug to the instances.list method to reduce the number of results returned. + +It also introduces pagination if the list returned is still too large. +--- + agents/gce/fence_gce.py | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/agents/gce/fence_gce.py b/agents/gce/fence_gce.py +index 759567c6f..c7bd2a5dc 100644 +--- a/agents/gce/fence_gce.py ++++ b/agents/gce/fence_gce.py +@@ -150,15 +150,24 @@ def get_nodes_list(conn, options): + result = {} + plug = options["--plug"] if "--plug" in options else "" + zones = options["--zone"] if "--zone" in options else "" ++ filter = "name="+plug if plug != "" else "" ++ max_results = 1 if options.get("--action") == "monitor" else 500 + if not zones: + zones = get_zone(conn, options, plug) if "--plugzonemap" not in options else options["--plugzonemap"][plug] + try: + for zone in zones.split(","): +- instanceList = retry_api_execute(options, conn.instances().list( ++ request = conn.instances().list( + project=options["--project"], +- zone=zone)) ++ zone=zone, ++ filter=filter, ++ maxResults=max_results) ++ while request is not None: ++ instanceList = retry_api_execute(options, request) ++ if "items" not in instanceList: ++ break + for instance in instanceList["items"]: + result[instance["id"]] = (instance["name"], translate_status(instance["status"])) ++ request = conn.instances().list_next(previous_request=request, previous_response=instanceList) + except Exception as err: + fail_fence_agent(options, "Failed: get_nodes_list: {}".format(str(err))) + diff --git a/SOURCES/RHEL-142459-fix-bundled-pyasn1-CVE-2026-23490.patch b/SOURCES/RHEL-142460-fix-bundled-pyasn1-CVE-2026-23490.patch similarity index 100% rename from SOURCES/RHEL-142459-fix-bundled-pyasn1-CVE-2026-23490.patch rename to SOURCES/RHEL-142460-fix-bundled-pyasn1-CVE-2026-23490.patch diff --git a/SOURCES/RHEL-145761-fence_ibm_vpc-fix-missing-statuses.patch b/SOURCES/RHEL-145088-fence_ibm_vpc-fix-missing-statuses.patch similarity index 100% rename from SOURCES/RHEL-145761-fence_ibm_vpc-fix-missing-statuses.patch rename to SOURCES/RHEL-145088-fence_ibm_vpc-fix-missing-statuses.patch diff --git a/SOURCES/RHEL-146351-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch b/SOURCES/RHEL-146344-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch similarity index 100% rename from SOURCES/RHEL-146351-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch rename to SOURCES/RHEL-146344-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch diff --git a/SOURCES/RHEL-157201-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch b/SOURCES/RHEL-157202-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch similarity index 100% rename from SOURCES/RHEL-157201-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch rename to SOURCES/RHEL-157202-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch diff --git a/SOURCES/RHEL-157201-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch b/SOURCES/RHEL-157202-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch similarity index 100% rename from SOURCES/RHEL-157201-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch rename to SOURCES/RHEL-157202-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch diff --git a/SPECS/fence-agents.spec b/SPECS/fence-agents.spec index 0b16710..de5dbe7 100644 --- a/SPECS/fence-agents.spec +++ b/SPECS/fence-agents.spec @@ -47,7 +47,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.10.0 -Release: 98%{?alphatag:.%{alphatag}}%{?dist}.13 +Release: 110%{?alphatag:.%{alphatag}}%{?dist}.3 License: GPLv2+ and LGPLv2+ URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -95,7 +95,7 @@ Source1407: isodate-0.6.1.tar.gz Source1408: msrest-0.7.1.zip Source1409: msrestazure-0.6.4.post1.tar.gz Source1410: %{oauthlib}-%{oauthlib_version}.tar.gz -Source1411: pyjwt-2.12.1.tar.gz +Source1411: pyjwt-2.13.0.tar.gz Source1412: requests_oauthlib-1.3.0-py2.py3-none-any.whl Source1413: msal-1.36.0.tar.gz Source1414: msal_extensions-1.3.1.tar.gz @@ -214,17 +214,20 @@ Patch69: RHEL-13088-fence_sbd-improve-error-handling.patch Patch70: RHEL-82193-fence_kubevirt-force-off.patch Patch71: RHEL-107505-fence_ibm_vpc-add-apikey-file-support.patch Patch72: RHEL-7601-fence_aws-add-skipshutdown-parameter.patch -Patch73: RHEL-145761-fence_ibm_vpc-fix-missing-statuses.patch +Patch73: RHEL-114753-fence_ibm_powervs-update-api-type-description.patch +Patch74: RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch +Patch75: RHEL-128926-2-fence_gce-fix-node-list-limit.patch +Patch76: RHEL-145088-fence_ibm_vpc-fix-missing-statuses.patch ### HA support libs/utils ### # all archs Patch1000: bz2217902-1-kubevirt-fix-bundled-dateutil-CVE-2007-4559.patch -Patch1001: RHEL-146351-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch -Patch1002: RHEL-157201-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch +Patch1001: RHEL-146344-kubevirt-fix-bundled-pyasn1-CVE-2026-23490.patch +Patch1002: RHEL-157202-1-kubevirt-fix-bundled-pyasn1-CVE-2026-30922.patch # cloud (x86_64 only) Patch2000: bz2217902-2-aws-azure-fix-bundled-dateutil-CVE-2007-4559.patch -Patch2001: RHEL-142459-fix-bundled-pyasn1-CVE-2026-23490.patch -Patch2002: RHEL-157201-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch +Patch2001: RHEL-142460-fix-bundled-pyasn1-CVE-2026-23490.patch +Patch2002: RHEL-157202-2-google-fix-bundled-pyasn1-CVE-2026-30922.patch %global supportedagents amt_ws apc apc_snmp bladecenter brocade cisco_mds cisco_ucs compute drac5 eaton_snmp emerson eps evacuate hpblade ibmblade ibm_powervs ibm_vpc ifmib ilo ilo_moonshot ilo_mp ilo_ssh intelmodular ipdu ipmilan kdump kubevirt lpar mpath nutanix_ahv redfish rhevm rsa rsb sbd scsi vmware_rest vmware_soap wti %ifarch x86_64 @@ -412,6 +415,9 @@ BuildRequires: %{systemd_units} %patch -p1 -P 71 %patch -p1 -P 72 -F2 %patch -p1 -P 73 +%patch -p1 -P 74 +%patch -p1 -P 75 +%patch -p1 -P 76 # prevent compilation of something that won't get used anyway sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac @@ -642,7 +648,7 @@ Provides: bundled(python-msrest) = 0.7.1 Provides: bundled(python-msrestazure) = 0.6.4.post1 Provides: bundled(python-%{oauthlib}) = %{oauthlib_version} Provides: bundled(python-portalocker) = 2.5.1 -Provides: bundled(python-PyJWT) = 2.12.1 +Provides: bundled(python-PyJWT) = 2.13.0 Provides: bundled(python-requests-oauthlib) = 1.3.0 Provides: bundled(python-typing-extensions) = 4.12.2 # google @@ -1510,40 +1516,53 @@ are located on corosync cluster nodes. %endif %changelog -* Wed Apr 29 2026 Oyvind Albrigtsen - 4.10.0-98.13 -- bundled pyasn1: fix CVE-2026-30922 - Resolves: RHEL-157201 +* Mon Jun 8 2026 Oyvind Albrigtsen - 4.10.0-110.3 +- bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 + Resolves: RHEL-182313 -* Thu Apr 16 2026 Oyvind Albrigtsen - 4.10.0-98.12 +* Wed Apr 29 2026 Oyvind Albrigtsen - 4.10.0-110.2 +- bundled pyasn1: fix CVE-2026-30922 + Resolves: RHEL-157202 + +* Thu Apr 16 2026 Oyvind Albrigtsen - 4.10.0-110.1 - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 - Resolves: RHEL-148436, RHEL-155675 + Resolves: RHEL-167241, RHEL-155676 -* Wed Feb 11 2026 Oyvind Albrigtsen - 4.10.0-98.10 +* Tue Feb 10 2026 Oyvind Albrigtsen - 4.10.0-110 - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs - Resolves: RHEL-146351 + Resolves: RHEL-146344 -* Thu Feb 5 2026 Oyvind Albrigtsen - 4.10.0-98.7 +* Thu Feb 5 2026 Oyvind Albrigtsen - 4.10.0-108 - bundled urllib3: fix issue with CVE-2026-21441 patch - Resolves: RHEL-146294 + Resolves: RHEL-146282 -* Tue Feb 3 2026 Oyvind Albrigtsen - 4.10.0-98.6 +* Thu Jan 29 2026 Oyvind Albrigtsen - 4.10.0-107 - fence_ibm_vpc: fix missing statuses - Resolves: RHEL-145761 + Resolves: RHEL-145088 -* Tue Jan 27 2026 Oyvind Albrigtsen - 4.10.0-98.5 +* Tue Jan 27 2026 Oyvind Albrigtsen - 4.10.0-106 - bundled pyasn1: fix CVE-2026-23490 - Resolves: RHEL-142459 + Resolves: RHEL-142460 -* Tue Jan 20 2026 Oyvind Albrigtsen - 4.10.0-98.4 +* Tue Jan 20 2026 Oyvind Albrigtsen - 4.10.0-105 - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 - Resolves: RHEL-139793, RHEL-140795 + Resolves: RHEL-139799, RHEL-140796 -* Mon Jan 5 2026 Oyvind Albrigtsen - 4.10.0-98.1 +* Fri Jan 2 2026 Oyvind Albrigtsen - 4.10.0-102 - bundled urllib3: fix CVE-2025-66418 - Resolves: RHEL-136061 + Resolves: RHEL-136069 + +* Tue Nov 18 2025 Oyvind Albrigtsen - 4.10.0-101 +- fence_gce: fix node list limit + Resolves: RHEL-128926 + +* Wed Sep 17 2025 Oyvind Albrigtsen - 4.10.0-100 +- fence_ibm_powervs: update description of api-type parameter to show + correct default value + Resolves: RHEL-114753 * Tue Aug 19 2025 Oyvind Albrigtsen - 4.10.0-98 - fence_aws: add "skip_os_shutdown" parameter to allow hard poweroff