The resource-agents packages in Red Hat Enterprise Linux provide scripts for service managers to operate in high-availability environments. This advisory addresses two main security issues: CVE-2024-6345, a remote code execution vulnerability in the setuptools package_index download functions, and CVE-2024-37891, where urllib3 fails to strip proxy-authorization headers during cross-origin redirects. These vulnerabilities could allow an attacker to execute arbitrary code or leak sensitive information under certain conditions. Red Hat has released updated packages for affected versions of Red Hat Enterprise Linux 8, including High Availability and Resilient Storage variants, to fix these issues. The advisory references official Red Hat errata and provides guidance for applying the updates.

The remote code execution vulnerability (CVE-2024-6345) in setuptools could allow an attacker to execute arbitrary code via crafted download functions, posing a significant risk to system integrity. The urllib3 issue (CVE-2024-37891) could lead to sensitive proxy-authorization headers being leaked during cross-origin redirects, potentially exposing credentials. Both vulnerabilities impact systems running affected Red Hat Enterprise Linux 8 variants, particularly those using resource-agents for high-availability services. No known exploits in the wild have been reported at this time.

Red Hat has released updated resource-agents packages that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2024:6311 and the related article https://access.redhat.com/articles/11258. The update is available for Red Hat Enterprise Linux 8 High Availability and Resilient Storage variants across multiple architectures. Applying the official update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.