The fence-agents packages in Red Hat Enterprise Linux 8 provide scripts for remote power management to forcibly restart and remove failed or unreachable cluster nodes. This advisory fixes two vulnerabilities: CVE-2024-37891 in urllib3, where the proxy-authorization header is improperly retained during cross-origin redirects, potentially leading to information disclosure; and CVE-2024-6345 in pypa/setuptools, which allows remote code execution via download functions in the package_index module. Red Hat has released updated fence-agents packages that address these issues. The update is rated as having moderate security impact and applies to various Red Hat Enterprise Linux 8 products and architectures. The vendor advisory provides detailed package versions and instructions for applying the update.

The vulnerabilities could allow an attacker to exploit the urllib3 proxy-authorization header handling flaw or execute remote code via the setuptools package_index module. This could lead to unauthorized actions on affected systems, including potential compromise of cluster node management. However, no known exploits in the wild have been reported. The overall security impact is rated moderate by Red Hat.

Red Hat has released updated fence-agents packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 8 variants should apply the security update as detailed in the Red Hat advisory RHSA-2024:6309. The vendor provides instructions for updating the packages at https://access.redhat.com/articles/11258. Applying the official update is the recommended remediation. No additional mitigation steps are indicated by the vendor.