Loading story…
Red Hat released the fence-agents update 4.2.1-129.el8_10.4 for Red Hat Enterprise Linux 8, remediating CVE-2024-6345 and CVE-2024-37891. The update applies across RHEL 8 systems using High Availability, Resilient Storage, and Extended Life Cycle variants on x86_64, ARM64, IBM Z, and IBM Power. Fence-agents provides remote power-management functions used by clusters to restart or isolate failed nodes, making timely patching important for environments that use these components.
CVE-2024-6345 is an important-severity flaw in PyPA setuptools' package_index download functions that can enable remote code execution when package URLs or index-derived download inputs are attacker-controlled; upstream setuptools 70.0 replaced shell-based Git cloning with argument-array subprocess execution. CVE-2024-37891 affects urllib3 and can expose Proxy-Authorization credentials when requests follow cross-origin redirects because the header is not reliably stripped. Red Hat backported fixes across supported products, so organizations should validate installed vendor package builds rather than relying only on upstream version comparisons.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
RHSA-2024:6765 remediated CVE-2024-37891 in python3x-urllib3 for Ansible Automation Platform 2.4 on RHEL 8 and python-urllib3 for the RHEL 9 offering.
Red Hat issued RHSA-2024:6311 to remediate CVE-2024-37891 in the RHEL 8 resource-agents package.
Red Hat issued RHSA-2024:5258 to remediate CVE-2024-37891 in the RHEL 8 container-tools:rhel8 package stream.
Red Hat issued RHEA-2024:4071 to fix CVE-2024-6345 in the rhdh/rhdh-hub-rhel9 component of Red Hat Developer Hub 1.2 on RHEL 9.
Red Hat issued RHSA-2024:8842 and RHSA-2024:8843 to remediate CVE-2024-37891 in RHEL 8 python3.12-urllib3 and python3.11-urllib3, respectively.
RHBA-2024:7523 fixed CVE-2024-37891 in the rhdh/rhdh-hub-rhel9 component of Red Hat Developer Hub 1.3 on RHEL 9.
Red Hat issued RHSA-2024:7312 to fix CVE-2024-37891 in Ansible Automation Platform 2.4 automation-controller packages for RHEL 8 and RHEL 9.
RHSA-2024:6662 fixed CVE-2024-6345 in the Red Hat Enterprise Linux 7 Extended Lifecycle Support python-setuptools package.
RHSA-2024:6661 fixed CVE-2024-6345 in the Red Hat Enterprise Linux 7 Extended Lifecycle Support python3-setuptools package.
Red Hat released fence-agents 4.2.1-129.el8_10.4 through RHSA-2024:6309, fixing CVE-2024-37891 and CVE-2024-6345 for applicable RHEL 8 variants.
RHSA-2024:5962 remediated CVE-2024-6345 in the RHEL 8 python39:3.9 and python39-devel:3.9 packages.
Red Hat issued RHSA-2024:5530, RHSA-2024:5531, and RHSA-2024:5532 to fix CVE-2024-6345 in RHEL 8 python-setuptools, python3.12-setuptools, and python3.11-setuptools packages.
The changelog for python3-setuptools-53.0.0-12.el9_4.1 recorded a security fix for CVE-2024-6345, delivered as a backport rather than an upstream version rebase.
A vulnerability in urllib3 was identified in which the Proxy-Authorization header may not be stripped during a cross-origin redirect, potentially exposing proxy authentication material.
Fedora published fixed python-setuptools packages for Fedora 40 (69.0.3-4.fc40) and Fedora 39 (67.7.2-8.fc39) to their stable repositories.
Setuptools 70.0 remediated CVE-2024-6345 by replacing shell-based git clone execution with an argument-array subprocess invocation.
PyPA setuptools through version 69.1.1 was identified as vulnerable to remote code execution when package_index download functions process attacker-controlled package URLs or other untrusted download inputs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2022:5626** for Red Hat Enterprise Linux 8.4 Extended Update Support, delivering kernel `4.18.0-305.57.1.el8_4` for x86_64, s390x, ppc64le, and aarch64. The update remediates six kernel vulnerabilities, including **CVE-2022-32250**, a netfilter use-after-free write that can enable local root escalation, and **CVE-2022-1729**, affecting `perf_event_open`. It also addresses cgroup migration permission handling in **CVE-2021-4197**, which can let a less-privileged process induce a privileged process to write through an attacker-created file descriptor, and **CVE-2021-4203**, a socket credential race that can crash the system or disclose kernel information. Red Hat also issued **RHBA-2022:5744** to update Red Hat OpenStack Platform 16.2 container images, incorporating the kernel security fixes for x86_64 and IBM Power ppc64le deployments. Organizations should install the applicable RHEL kernel update and reboot hosts for remediation to take effect; OpenStack Platform users should upgrade the supplied container images and rebuild dependent images.
Aug 26, 2026
Red Hat released Important-rated security updates for `urllib3` across Red Hat Enterprise Linux 8, 9, and 10 to remediate `CVE-2026-44432` and `CVE-2026-44431`. The more severe issue, `CVE-2026-44432`, is a denial-of-service flaw in the Python HTTP client library that can let a remote attacker force excessive CPU and memory consumption when `urllib3` fully decompresses an HTTP response even though only a partial read was requested, or when it drains a connection after partial decompression. Red Hat assigned the bug a CVSS v3 score of 7.5 and mapped it to `CWE-409`. The advisories cover multiple package streams and architectures, including `python-urllib3` for RHEL 10, `python3.14-urllib3` for RHEL 9 and 10, and `python3.12-urllib3` for RHEL 8 and 9, with fixes delivered in versions such as `1.26.19-4.el10_2`, `2.6.3-2.el10_2`, `2.6.3-2.el9_8`, `1.26.19-3.el9_8`, and `1.26.19-3.el8_10`. Red Hat said the same updates also address `CVE-2026-44431`, an information disclosure flaw in which sensitive headers may be forwarded across origins during redirects, and listed affected offerings including Extended Update Support, Extended Life Cycle releases, and Red Hat Ansible Automation Platform 2.5 and 2.6 as fixed.
Aug 27, 2026
Red Hat released Important security updates for Red Hat Enterprise Linux 8 kernel and Real Time kernel deployments, remediating multiple vulnerabilities including **CVE-2023-2163**, an eBPF verifier-pruning flaw that can permit arbitrary kernel-memory reads and writes, privilege escalation, and container escape. Other fixes address a use-after-free in NVMe-over-TCP crypto cleanup (**CVE-2023-5178**), an AMD cross-process information disclosure issue (**CVE-2023-20593**), a DVB Common Interface driver use-after-free (**CVE-2022-45919**), network scheduler defects, and an SCTP NULL-pointer dereference. Affected organizations should deploy the applicable RHEL 8 kernel packages, including `kernel-rt-4.18.0-513.9.1.rt7.311.el8_9` for covered Real Time offerings and `kernel-4.18.0-372.80.1.el8_6` for RHEL 8.6 extended-support systems, then reboot to activate the fixes. Red Hat also delivered a kpatch update for RHEL 8.2 SAP Solutions that mitigates **CVE-2023-3812**, an oversized-packet flaw in the TUN driver; its live-patch module loads automatically and does not require a conventional reboot. Red Hat notes that exploiting CVE-2023-2163 on RHEL generally requires `CAP_SYS_ADMIN` or root because unprivileged eBPF is disabled by default.
Aug 26, 2026