The fence-agents packages in Red Hat Enterprise Linux 9.0 contain two security vulnerabilities in the Jinja2 template engine, identified as CVE-2024-56201 and CVE-2024-56326. Both vulnerabilities involve sandbox breakout techniques: one through malicious filenames and the other through indirect references to the format method. These flaws could allow an attacker to escape the sandbox restrictions imposed by Jinja2, potentially leading to unauthorized code execution within the context of the fence-agents scripts. The fence-agents scripts manage remote power operations for cluster nodes, so exploitation could impact cluster stability and management. Red Hat has released an update to address these issues in the affected packages. The advisory does not provide CVSS scores but rates the impact as important.

Successful exploitation of these vulnerabilities could allow an attacker to bypass Jinja2 sandbox restrictions within the fence-agents scripts, potentially leading to unauthorized code execution or manipulation of cluster node management. This could disrupt cluster operations by forcibly restarting or removing nodes improperly. However, there are no known exploits in the wild at this time. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical system compromise.

Red Hat has released security updates for the fence-agents packages in Red Hat Enterprise Linux 9.0 to address these Jinja2 sandbox breakout vulnerabilities. Users should apply the provided updates promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as an official fix available via the update.