The fence-agents packages in Red Hat Enterprise Linux 9.4 and related variants include scripts for managing remote power control of cluster nodes. Two security issues in the Jinja2 template engine used by these packages allow sandbox breakout: CVE-2024-56201 via malicious filenames and CVE-2024-56326 via indirect references to the format method. These vulnerabilities can lead to execution of unauthorized code outside the intended sandbox environment. Red Hat has issued an important security advisory (RHSA-2025:0338) with updates to fence-agents that fix these vulnerabilities. The advisory covers multiple Red Hat Enterprise Linux 9.4 Extended Update Support and Update Services for SAP Solutions products. No CVSS scores are provided in the advisory, and no active exploitation has been reported.

Successful exploitation of these vulnerabilities could allow an attacker to escape the Jinja2 sandbox in the fence-agents scripts, potentially leading to unauthorized code execution on affected systems. This could compromise cluster node management, allowing forced restarts or removal of nodes by an attacker. The vulnerabilities affect multiple Red Hat Enterprise Linux 9.4 variants used in cluster environments. No known exploits in the wild have been reported at this time.

Red Hat has released an important security update for the fence-agents packages that addresses these Jinja2 sandbox breakout vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and Update Services for SAP Solutions products should apply the update as described in Red Hat advisory RHSA-2025:0338 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.