The fence-agents packages in Red Hat Enterprise Linux 9 contain two security flaws related to the Jinja templating engine sandbox. CVE-2024-56201 allows sandbox breakout through malicious filenames, while CVE-2024-56326 enables sandbox breakout via indirect references to the format method. These vulnerabilities could allow an attacker to bypass sandbox restrictions within fence-agents scripts, which manage remote power control of cluster nodes. Red Hat has released updates for fence-agents to fix these issues in Red Hat Enterprise Linux 9.

Successful exploitation of these vulnerabilities could allow an attacker to escape the Jinja sandbox in fence-agents, potentially leading to unauthorized code execution or manipulation within the context of cluster remote power management. This could affect the stability and security of cluster operations by enabling forced restarts or removals of nodes under attacker control. The severity is rated high by Red Hat.

Red Hat has released security updates for fence-agents in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2025:0308 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.