The resource-agents packages provide scripts for Pacemaker and RGManager service managers to enable high-availability operations. This security update addresses two vulnerabilities: CVE-2024-37891 in urllib3, involving improper handling of proxy-authorization headers during cross-origin redirects, and CVE-2024-6345 in pypa/setuptools, which allows remote code execution via download functions in the package_index module. Red Hat has released updated resource-agents packages for Red Hat Enterprise Linux 8 variants to fix these issues. The advisory does not include CVSS scores but classifies the impact as moderate.

The vulnerabilities could allow an attacker to exploit improper header handling in urllib3 or execute remote code through setuptools download functions, potentially compromising systems running affected Red Hat Enterprise Linux High Availability or Resilient Storage packages. The overall security impact is rated moderate by Red Hat Product Security. There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated resource-agents packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2024:6311 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the issues. No additional mitigation steps are indicated by the vendor.