The fence-agents packages in Red Hat Enterprise Linux 8.4 and 8.8 contain a vulnerability identified as CVE-2024-34064, where the jinja2 template engine accepts keys containing non-attribute characters. This vulnerability is rated as moderate severity by Red Hat Product Security. Fence-agents provide scripts for remote power management of cluster devices, enabling forced restart and removal of failed or unreachable nodes. Red Hat has issued security advisories RHSA-2024:3811 and RHSA-2024:3795 providing updated fence-agents packages that fix this issue. The advisories cover multiple architectures and variants of Red Hat Enterprise Linux 8.4 and 8.8, including Extended Update Support and Update Services for SAP Solutions.

The vulnerability affects the jinja2 template engine used by fence-agents, potentially allowing keys with non-attribute characters to be accepted. This could impact the security of remote power management operations in cluster environments, possibly allowing unintended behavior when managing failed or unreachable nodes. The overall security impact is rated as moderate by Red Hat. There are no known exploits in the wild at this time.

Red Hat has released updated fence-agents packages that address CVE-2024-34064. Users of affected Red Hat Enterprise Linux 8.4 and 8.8 variants should apply the security updates as detailed in Red Hat advisories RHSA-2024:3811 and RHSA-2024:3795. Instructions for applying these updates are available at https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigation steps are indicated by the vendor.