<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="1">
    <id>ALSA-2022:6314</id>
    <title>Important: pcs security update</title>
    <issued date="2022-09-01 00:00:00"/>
    <updated date="2022-10-07 07:53:52"/>
    <rights>Copyright 2022 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pcs security update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* pcs: obtaining an authentication token for hacluster user could lead to privilege escalation (CVE-2022-2735)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2022:6314" id="RHSA-2022:6314" type="rhsa" title="RHSA-2022:6314"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2022-2735" id="CVE-2022-2735" type="cve" title="CVE-2022-2735"/>
      <reference href="https://bugzilla.redhat.com/2116815" id="2116815" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2022-6314.html" id="ALSA-2022:6314" type="self" title="ALSA-2022:6314"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default</name>
        <package name="pcs" version="0.10.12" release="6.el8_6.2.alma" epoch="0" arch="aarch64" src="pcs-0.10.12-6.el8_6.2.alma.src.rpm">
          <filename>pcs-0.10.12-6.el8_6.2.alma.aarch64.rpm</filename>
          <sum type="sha256">0ef6f9b7617f8102560bfa3e6faab90d6918481099bc4c123bd0130e00371ac3</sum>
        </package>
        <package name="pcs-snmp" version="0.10.12" release="6.el8_6.2.alma" epoch="0" arch="aarch64" src="pcs-0.10.12-6.el8_6.2.alma.src.rpm">
          <filename>pcs-snmp-0.10.12-6.el8_6.2.alma.aarch64.rpm</filename>
          <sum type="sha256">4b6d88b4fe8de3ee5e448df4d2824cf6c794aa0dffcad33307a8b0e5446c4f26</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="1">
    <id>ALSA-2022:6439</id>
    <title>Moderate: booth security update</title>
    <issued date="2022-09-13 00:00:00"/>
    <updated date="2022-10-11 13:01:02"/>
    <rights>Copyright 2022 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>booth security update</summary>
    <description>The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time.

Security Fix(es):

* booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2022:6439" id="RHSA-2022:6439" type="rhsa" title="RHSA-2022:6439"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2022-2553" id="CVE-2022-2553" type="cve" title="CVE-2022-2553"/>
      <reference href="https://bugzilla.redhat.com/2109251" id="2109251" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2022-6439.html" id="ALSA-2022:6439" type="self" title="ALSA-2022:6439"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default</name>
        <package name="booth-arbitrator" version="1.0" release="199.1.ac1d34c.git.el8_6.1" epoch="0" arch="noarch" src="booth-1.0-199.1.ac1d34c.git.el8_6.1.src.rpm">
          <filename>booth-arbitrator-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm</filename>
          <sum type="sha256">01c0dac9a8f42077035f4e5c03b5449c69c6f6a9c80ae995d05dcde15ca8a6a7</sum>
        </package>
        <package name="booth-site" version="1.0" release="199.1.ac1d34c.git.el8_6.1" epoch="0" arch="noarch" src="booth-1.0-199.1.ac1d34c.git.el8_6.1.src.rpm">
          <filename>booth-site-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm</filename>
          <sum type="sha256">49521ed948e3e12ec2970897efe740f7dca8ad85091475b4e3edb8c07cacdc45</sum>
        </package>
        <package name="booth" version="1.0" release="199.1.ac1d34c.git.el8_6.1" epoch="0" arch="aarch64" src="booth-1.0-199.1.ac1d34c.git.el8_6.1.src.rpm">
          <filename>booth-1.0-199.1.ac1d34c.git.el8_6.1.aarch64.rpm</filename>
          <sum type="sha256">52952f4a3aa45cc166a1bcfa3bc2e0c19a9a027d3e3e0e5c88a8b578dfcbf582</sum>
        </package>
        <package name="booth-test" version="1.0" release="199.1.ac1d34c.git.el8_6.1" epoch="0" arch="noarch" src="booth-1.0-199.1.ac1d34c.git.el8_6.1.src.rpm">
          <filename>booth-test-1.0-199.1.ac1d34c.git.el8_6.1.noarch.rpm</filename>
          <sum type="sha256">9ba23dd05371c3e52f54f1a8d5ad6d78a1fb9a9aabf50b24d14888b0d7679a41</sum>
        </package>
        <package name="booth-core" version="1.0" release="199.1.ac1d34c.git.el8_6.1" epoch="0" arch="aarch64" src="booth-1.0-199.1.ac1d34c.git.el8_6.1.src.rpm">
          <filename>booth-core-1.0-199.1.ac1d34c.git.el8_6.1.aarch64.rpm</filename>
          <sum type="sha256">ea76cddf44aa6e04d731315393c832fc1069c792a84ee45a02bac468baa10395</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="1">
    <id>ALSA-2022:7447</id>
    <title>Moderate: pcs security, bug fix, and enhancement update</title>
    <issued date="2022-11-08 00:00:00"/>
    <updated date="2022-11-12 03:07:05"/>
    <rights>Copyright 2022 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>pcs security, bug fix, and enhancement update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* pcs: improper authentication via PAM (CVE-2022-1049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2022:7447" id="RHSA-2022:7447" type="rhsa" title="RHSA-2022:7447"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2022-1049" id="CVE-2022-1049" type="cve" title="CVE-2022-1049"/>
      <reference href="https://bugzilla.redhat.com/2066629" id="2066629" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2022-7447.html" id="ALSA-2022:7447" type="self" title="ALSA-2022:7447"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_6_default</name>
        <package name="pcs" version="0.10.14" release="5.el8.alma" epoch="0" arch="aarch64" src="pcs-0.10.14-5.el8.alma.src.rpm">
          <filename>pcs-0.10.14-5.el8.alma.aarch64.rpm</filename>
          <sum type="sha256">7ce013005a5f0ffc06c5d2b66a5ec1d4f46d24bea3c9cfef19d0dc72367f1e89</sum>
        </package>
        <package name="pcs-snmp" version="0.10.14" release="5.el8.alma" epoch="0" arch="aarch64" src="pcs-0.10.14-5.el8.alma.src.rpm">
          <filename>pcs-snmp-0.10.14-5.el8.alma.aarch64.rpm</filename>
          <sum type="sha256">de5f37d4889cf93a5a2fd9a9067ce59c805465db1729ea93a1cfe472afebcad9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="1">
    <id>ALSA-2023:3082</id>
    <title>Moderate: pcs security and bug fix update</title>
    <issued date="2023-05-16 00:00:00"/>
    <updated date="2023-05-19 22:00:28"/>
    <rights>Copyright 2023 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>pcs security and bug fix update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
* rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700)
* Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706)</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2023:3082" id="RHSA-2023:3082" type="rhsa" title="RHSA-2023:3082"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-27530" id="CVE-2023-27530" type="cve" title="CVE-2023-27530"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-27539" id="CVE-2023-27539" type="cve" title="CVE-2023-27539"/>
      <reference href="https://bugzilla.redhat.com/2176477" id="2176477" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2179649" id="2179649" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2023-3082.html" id="ALSA-2023:3082" type="self" title="ALSA-2023:3082"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_8_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_8_default</name>
        <package name="pcs-snmp" version="0.10.15" release="4.el8_8.1.alma" epoch="0" arch="aarch64" src="pcs-0.10.15-4.el8_8.1.alma.src.rpm">
          <filename>pcs-snmp-0.10.15-4.el8_8.1.alma.aarch64.rpm</filename>
          <sum type="sha256">66ef34d8a5590d5be4bdf1f9b65aedf5292b947279c2938db3ba1f9daa7f8ce0</sum>
        </package>
        <package name="pcs" version="0.10.15" release="4.el8_8.1.alma" epoch="0" arch="aarch64" src="pcs-0.10.15-4.el8_8.1.alma.src.rpm">
          <filename>pcs-0.10.15-4.el8_8.1.alma.aarch64.rpm</filename>
          <sum type="sha256">b815d36aec29271f1586cd832d65300c9b585c77d4d99aca3f969596bacfa841</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:2952</id>
    <title>Moderate: resource-agents security and bug fix update</title>
    <issued date="2024-05-22 00:00:00"/>
    <updated date="2024-05-29 14:39:49"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>resource-agents security and bug fix update</summary>
    <description>The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.

Security Fix(es):

* urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
* pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:2952" id="RHSA-2024:2952" type="rhsa" title="RHSA-2024:2952"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-45803" id="CVE-2023-45803" type="cve" title="CVE-2023-45803"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-52323" id="CVE-2023-52323" type="cve" title="CVE-2023-52323"/>
      <reference href="https://bugzilla.redhat.com/2246840" id="2246840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2257028" id="2257028" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-2952.html" id="ALSA-2024:2952" type="self" title="ALSA-2024:2952"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default</name>
        <package name="resource-agents-paf" version="4.9.0" release="54.el8" epoch="0" arch="aarch64" src="resource-agents-4.9.0-54.el8.src.rpm">
          <filename>resource-agents-paf-4.9.0-54.el8.aarch64.rpm</filename>
          <sum type="sha256">bca105368822ffed8b514f68d167f5ee95fb93552973c86bb31a25a2fcb76e51</sum>
        </package>
        <package name="resource-agents" version="4.9.0" release="54.el8" epoch="0" arch="aarch64" src="resource-agents-4.9.0-54.el8.src.rpm">
          <filename>resource-agents-4.9.0-54.el8.aarch64.rpm</filename>
          <sum type="sha256">e35d2f531e2bbf0c23eed6d8c3509080bd159288e8ca8e495c12160a9679dc78</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:2953</id>
    <title>Moderate: pcs security update</title>
    <issued date="2024-05-22 00:00:00"/>
    <updated date="2024-05-29 14:39:49"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>pcs security update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)
* rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)
* rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:2953" id="RHSA-2024:2953" type="rhsa" title="RHSA-2024:2953"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-25126" id="CVE-2024-25126" type="cve" title="CVE-2024-25126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-26141" id="CVE-2024-26141" type="cve" title="CVE-2024-26141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-26146" id="CVE-2024-26146" type="cve" title="CVE-2024-26146"/>
      <reference href="https://bugzilla.redhat.com/2265593" id="2265593" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2265594" id="2265594" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2265595" id="2265595" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-2953.html" id="ALSA-2024:2953" type="self" title="ALSA-2024:2953"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default</name>
        <package name="pcs-snmp" version="0.10.18" release="2.el8_10" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.src.rpm">
          <filename>pcs-snmp-0.10.18-2.el8_10.aarch64.rpm</filename>
          <sum type="sha256">0e543b51a7ad18d8530fd741e5044e7de1cb515dfbc9faa94607df647a801281</sum>
        </package>
        <package name="pcs" version="0.10.18" release="2.el8_10" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.src.rpm">
          <filename>pcs-0.10.18-2.el8_10.aarch64.rpm</filename>
          <sum type="sha256">ae3f9e10f298a050bbf36629d25a817218ff80b898d162f3f3b3fc37c3881566</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:2968</id>
    <title>Moderate: fence-agents security and bug fix update</title>
    <issued date="2024-05-22 00:00:00"/>
    <updated date="2024-05-29 14:46:47"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>fence-agents security and bug fix update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
* pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)
* jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:2968" id="RHSA-2024:2968" type="rhsa" title="RHSA-2024:2968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-45803" id="CVE-2023-45803" type="cve" title="CVE-2023-45803"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-52323" id="CVE-2023-52323" type="cve" title="CVE-2023-52323"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-22195" id="CVE-2024-22195" type="cve" title="CVE-2024-22195"/>
      <reference href="https://bugzilla.redhat.com/2246840" id="2246840" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2257028" id="2257028" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2257854" id="2257854" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-2968.html" id="ALSA-2024:2968" type="self" title="ALSA-2024:2968"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_9_default</name>
        <package name="fence-agents-azure-arm" version="4.2.1" release="129.el8" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8.src.rpm">
          <filename>fence-agents-azure-arm-4.2.1-129.el8.noarch.rpm</filename>
          <sum type="sha256">3ddff0c91dfd33733373dc8e9ff157f19db47f5d98d3f50558c5adeda8d5d464</sum>
        </package>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8.noarch.rpm</filename>
          <sum type="sha256">4c6736c06d44a17575fd6f648aca2e1c2a2e820891c1654702a2f4a191dfa30e</sum>
        </package>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8.noarch.rpm</filename>
          <sum type="sha256">d4a1648ba4e62c910380cf694ec9136b21f17c7567690cdb009788c2e59228c5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:3659</id>
    <title>Important: booth security update</title>
    <issued date="2024-06-06 00:00:00"/>
    <updated date="2024-06-11 12:24:50"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>booth security update</summary>
    <description>The Booth cluster ticket manager is a component to bridge high availability
clusters spanning multiple sites, in particular, to provide decision inputs to
local Pacemaker cluster resource managers. It operates as a distributed
consensus-based service, presumably on a separate physical network. Tickets
facilitated by a Booth formation are the units of authorization that can be
bound to certain resources. This will ensure that the resources are run at only
one (granted) site at a time.

Security Fix(es):

* booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server  (CVE-2024-3049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:3659" id="RHSA-2024:3659" type="rhsa" title="RHSA-2024:3659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-3049" id="CVE-2024-3049" type="cve" title="CVE-2024-3049"/>
      <reference href="https://bugzilla.redhat.com/2272082" id="2272082" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-3659.html" id="ALSA-2024:3659" type="self" title="ALSA-2024:3659"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="booth-arbitrator" version="1.1" release="1.el8_10.1" epoch="0" arch="noarch" src="booth-1.1-1.el8_10.1.src.rpm">
          <filename>booth-arbitrator-1.1-1.el8_10.1.noarch.rpm</filename>
          <sum type="sha256">2ed42efdc796a6e5db1ceefca4ffb07a8bac87521853a49c3bf5e94878171c8b</sum>
        </package>
        <package name="booth" version="1.1" release="1.el8_10.1" epoch="0" arch="aarch64" src="booth-1.1-1.el8_10.1.src.rpm">
          <filename>booth-1.1-1.el8_10.1.aarch64.rpm</filename>
          <sum type="sha256">85ea6407e2a5f69392c6962042722f0d32f155d2af3af983d3317ed4b17a690b</sum>
        </package>
        <package name="booth-site" version="1.1" release="1.el8_10.1" epoch="0" arch="noarch" src="booth-1.1-1.el8_10.1.src.rpm">
          <filename>booth-site-1.1-1.el8_10.1.noarch.rpm</filename>
          <sum type="sha256">9186b82d9917d72fb035cc9091e649749cda857a06ed91c147918cc90bec0e1a</sum>
        </package>
        <package name="booth-test" version="1.1" release="1.el8_10.1" epoch="0" arch="noarch" src="booth-1.1-1.el8_10.1.src.rpm">
          <filename>booth-test-1.1-1.el8_10.1.noarch.rpm</filename>
          <sum type="sha256">a2b68433ada8ea79abd222e70084898349c77f54dc97321ba47c40a2317a4551</sum>
        </package>
        <package name="booth-core" version="1.1" release="1.el8_10.1" epoch="0" arch="aarch64" src="booth-1.1-1.el8_10.1.src.rpm">
          <filename>booth-core-1.1-1.el8_10.1.aarch64.rpm</filename>
          <sum type="sha256">a5bf69a91d34fdbc8e219fc1a72d0f82b170d74a3ab25cc0fe430255d1863ed5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:5338</id>
    <title>Low: pcs security update</title>
    <issued date="2024-08-13 00:00:00"/>
    <updated date="2024-08-21 12:21:21"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>pcs security update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* REXML: DoS parsing an XML with many `&lt;`s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:5338" id="RHSA-2024:5338" type="rhsa" title="RHSA-2024:5338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-35176" id="CVE-2024-35176" type="cve" title="CVE-2024-35176"/>
      <reference href="https://bugzilla.redhat.com/2280894" id="2280894" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-5338.html" id="ALSA-2024:5338" type="self" title="ALSA-2024:5338"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="pcs-snmp" version="0.10.18" release="2.el8_10.1" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.1.src.rpm">
          <filename>pcs-snmp-0.10.18-2.el8_10.1.aarch64.rpm</filename>
          <sum type="sha256">3ffb571f1e4e87deaff59bb75f83232ca21285ac1521a6fe45eaac7eac43b745</sum>
        </package>
        <package name="pcs" version="0.10.18" release="2.el8_10.1" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.1.src.rpm">
          <filename>pcs-0.10.18-2.el8_10.1.aarch64.rpm</filename>
          <sum type="sha256">a6194b2e6bf7a5e93c35f7533f9118ab148751599c4136b77039e85c7ce06bcb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:6309</id>
    <title>Moderate: fence-agents security update</title>
    <issued date="2024-09-04 00:00:00"/>
    <updated date="2024-09-05 06:36:28"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
* pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:6309" id="RHSA-2024:6309" type="rhsa" title="RHSA-2024:6309"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-37891" id="CVE-2024-37891" type="cve" title="CVE-2024-37891"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-6345" id="CVE-2024-6345" type="cve" title="CVE-2024-6345"/>
      <reference href="https://bugzilla.redhat.com/2292788" id="2292788" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2297771" id="2297771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-6309.html" id="ALSA-2024:6309" type="self" title="ALSA-2024:6309"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8_10.4" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.4.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8_10.4.noarch.rpm</filename>
          <sum type="sha256">32f6bd49eb54b3db836cd290c0da82d8cc0617d9978e6566e350d956ca31b108</sum>
        </package>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8_10.4" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.4.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8_10.4.noarch.rpm</filename>
          <sum type="sha256">56c91a605a010fe43299ecf2596888ed7d641c849997fd647ca3942cc420407d</sum>
        </package>
        <package name="fence-agents-azure-arm" version="4.2.1" release="129.el8_10.4" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.4.src.rpm">
          <filename>fence-agents-azure-arm-4.2.1-129.el8_10.4.noarch.rpm</filename>
          <sum type="sha256">96de6611355be0aa0614306425bea193d186862218db1c724dd693fe26aedc41</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:6311</id>
    <title>Moderate: resource-agents security update</title>
    <issued date="2024-09-04 00:00:00"/>
    <updated date="2024-09-05 06:29:01"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>resource-agents security update</summary>
    <description>The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.

Security Fix(es):

* urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
* pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:6311" id="RHSA-2024:6311" type="rhsa" title="RHSA-2024:6311"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-37891" id="CVE-2024-37891" type="cve" title="CVE-2024-37891"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-6345" id="CVE-2024-6345" type="cve" title="CVE-2024-6345"/>
      <reference href="https://bugzilla.redhat.com/2292788" id="2292788" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2297771" id="2297771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-6311.html" id="ALSA-2024:6311" type="self" title="ALSA-2024:6311"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="resource-agents" version="4.9.0" release="54.el8_10.4" epoch="0" arch="aarch64" src="resource-agents-4.9.0-54.el8_10.4.src.rpm">
          <filename>resource-agents-4.9.0-54.el8_10.4.aarch64.rpm</filename>
          <sum type="sha256">915f45b4bf66ed762e5a3d96b0dc2154e1789a72d4ab9009efd9c14765fc5984</sum>
        </package>
        <package name="resource-agents-paf" version="4.9.0" release="54.el8_10.4" epoch="0" arch="aarch64" src="resource-agents-4.9.0-54.el8_10.4.src.rpm">
          <filename>resource-agents-paf-4.9.0-54.el8_10.4.aarch64.rpm</filename>
          <sum type="sha256">a409a0e96d063081226e31b0d5211e05267c6775b97ca81aff683e2d9c5a678d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2024:6670</id>
    <title>Moderate: pcs security update</title>
    <issued date="2024-09-16 00:00:00"/>
    <updated date="2024-09-17 09:59:43"/>
    <rights>Copyright 2024 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>pcs security update</summary>
    <description>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, &gt;] and ]&gt; (CVE-2024-41123)
* rexml: DoS vulnerability in REXML (CVE-2024-41946)
* rexml: DoS vulnerability in REXML (CVE-2024-43398)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2024:6670" id="RHSA-2024:6670" type="rhsa" title="RHSA-2024:6670"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-41123" id="CVE-2024-41123" type="cve" title="CVE-2024-41123"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-41946" id="CVE-2024-41946" type="cve" title="CVE-2024-41946"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-43398" id="CVE-2024-43398" type="cve" title="CVE-2024-43398"/>
      <reference href="https://bugzilla.redhat.com/2302268" id="2302268" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2302272" id="2302272" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2307297" id="2307297" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2024-6670.html" id="ALSA-2024:6670" type="self" title="ALSA-2024:6670"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="pcs-snmp" version="0.10.18" release="2.el8_10.2.alma.1" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.2.alma.1.src.rpm">
          <filename>pcs-snmp-0.10.18-2.el8_10.2.alma.1.aarch64.rpm</filename>
          <sum type="sha256">11d449632833ec458b0008750fc86af6194bb470840613b02ca71a28ff3fb2db</sum>
        </package>
        <package name="pcs" version="0.10.18" release="2.el8_10.2.alma.1" epoch="0" arch="aarch64" src="pcs-0.10.18-2.el8_10.2.alma.1.src.rpm">
          <filename>pcs-0.10.18-2.el8_10.2.alma.1.aarch64.rpm</filename>
          <sum type="sha256">d0fca1f05c1467b82f47961db9b3a20dfd241e5984ce4664bcf7bf80f763b736</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:12176</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-04-30 00:00:00"/>
    <updated date="2026-04-30 11:53:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)
  * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)
  * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:12176" id="RHSA-2026:12176" type="rhsa" title="RHSA-2026:12176"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-26007" id="CVE-2026-26007" type="cve" title="CVE-2026-26007"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597"/>
      <reference href="https://bugzilla.redhat.com/2438762" id="2438762" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447194" id="2447194" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448553" id="2448553" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2026-12176.html" id="ALSA-2026:12176" type="self" title="ALSA-2026:12176"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8_10.25" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.25.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8_10.25.noarch.rpm</filename>
          <sum type="sha256">be513db6fdebbab74772197e16785f71a8cccbffdb2aa8a44005c805487f860e</sum>
        </package>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8_10.25" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.25.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8_10.25.noarch.rpm</filename>
          <sum type="sha256">ea01f2ced268ea06be9ca086b465349a0c8952357f15a7e14829670da9e209a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:1240</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-01-26 00:00:00"/>
    <updated date="2026-04-15 06:59:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)
  * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)
  * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:1240" id="RHSA-2026:1240" type="rhsa" title="RHSA-2026:1240"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-66418" id="CVE-2025-66418" type="cve" title="CVE-2025-66418"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-66471" id="CVE-2025-66471" type="cve" title="CVE-2025-66471"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-21441" id="CVE-2026-21441" type="cve" title="CVE-2026-21441"/>
      <reference href="https://bugzilla.redhat.com/2419455" id="2419455" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2419467" id="2419467" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2427726" id="2427726" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2026-1240.html" id="ALSA-2026:1240" type="self" title="ALSA-2026:1240"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8_10.20" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.20.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8_10.20.noarch.rpm</filename>
          <sum type="sha256">9f2d301e157213fe9852be7f1623254f1f18e81cccf8198ae0e005f0eb6d50b6</sum>
        </package>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8_10.20" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.20.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8_10.20.noarch.rpm</filename>
          <sum type="sha256">a3f7ffa8d683f949e2a77ed2843efb02fcc9fc1a8c9a3360efb3ac033d0a044b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:1906</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-02-04 00:00:00"/>
    <updated date="2026-02-10 08:07:01"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:1906" id="RHSA-2026:1906" type="rhsa" title="RHSA-2026:1906"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490"/>
      <reference href="https://bugzilla.redhat.com/2430472" id="2430472" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2026-1906.html" id="ALSA-2026:1906" type="self" title="ALSA-2026:1906"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8_10.21" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.21.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8_10.21.noarch.rpm</filename>
          <sum type="sha256">22167e15c2afc4e2d256b3658aeba654f2bbd1af090838c5e1472234168090f7</sum>
        </package>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8_10.21" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.21.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8_10.21.noarch.rpm</filename>
          <sum type="sha256">90c8058ea41fc6cfa37798fb800f9b4bdbd0b6181b3b17967edeb3fce2c7cb9d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39322</id>
    <title>Important: pacemaker security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:40:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>pacemaker security update</summary>
    <description>The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures.   

Security Fix(es):  

  * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39322" id="RHSA-2026:39322" type="rhsa" title="RHSA-2026:39322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10649" id="CVE-2026-10649" type="cve" title="CVE-2026-10649"/>
      <reference href="https://bugzilla.redhat.com/2462817" id="2462817" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2026-39322.html" id="ALSA-2026:39322" type="self" title="ALSA-2026:39322"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="python3-pacemaker" version="2.1.7" release="5.6.el8_10" epoch="0" arch="noarch" src="pacemaker-2.1.7-5.6.el8_10.src.rpm">
          <filename>python3-pacemaker-2.1.7-5.6.el8_10.noarch.rpm</filename>
          <sum type="sha256">00407e31173f1e2233a3501bd96969e8c992b986c6ab400db6dd5987f5c00165</sum>
        </package>
        <package name="pacemaker-nagios-plugins-metadata" version="2.1.7" release="5.6.el8_10" epoch="0" arch="noarch" src="pacemaker-2.1.7-5.6.el8_10.src.rpm">
          <filename>pacemaker-nagios-plugins-metadata-2.1.7-5.6.el8_10.noarch.rpm</filename>
          <sum type="sha256">9c94ead9243c89a429c37a087700b44d382a4cde882d2c098d880896f51f927b</sum>
        </package>
        <package name="pacemaker-doc" version="2.1.7" release="5.6.el8_10" epoch="0" arch="noarch" src="pacemaker-2.1.7-5.6.el8_10.src.rpm">
          <filename>pacemaker-doc-2.1.7-5.6.el8_10.noarch.rpm</filename>
          <sum type="sha256">eab22ee24e527a60e61fb41753cc3309d4a162107f4df05181754c631ff2cb2d</sum>
        </package>
        <package name="pacemaker-cts" version="2.1.7" release="5.6.el8_10" epoch="0" arch="noarch" src="pacemaker-2.1.7-5.6.el8_10.src.rpm">
          <filename>pacemaker-cts-2.1.7-5.6.el8_10.noarch.rpm</filename>
          <sum type="sha256">fc6685eaa7b8fabcda08385452c19c48889fe1c09e25cc1c4691b89e3cc954c9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47736</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-07-29 00:00:00"/>
    <updated date="2026-07-31 12:35:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>fence-agents security update</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   

Security Fix(es):  

  * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47736" id="RHSA-2026:47736" type="rhsa" title="RHSA-2026:47736"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59939" id="CVE-2026-59939" type="cve" title="CVE-2026-59939"/>
      <reference href="https://bugzilla.redhat.com/2498212" id="2498212" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/8/ALSA-2026-47736.html" id="ALSA-2026:47736" type="self" title="ALSA-2026:47736"/>
    </references>
    <pkglist>
      <collection short="almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default">
        <name>almalinux-8-for-aarch64-resilientstorage-rpms__8_10_default</name>
        <package name="fence-agents-aws" version="4.2.1" release="129.el8_10.27" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.27.src.rpm">
          <filename>fence-agents-aws-4.2.1-129.el8_10.27.noarch.rpm</filename>
          <sum type="sha256">01a3e896b3a9ca6a07fff581ae09cd7c0314493ea080d70877e7299dfd463700</sum>
        </package>
        <package name="fence-agents-gce" version="4.2.1" release="129.el8_10.27" epoch="0" arch="noarch" src="fence-agents-4.2.1-129.el8_10.27.src.rpm">
          <filename>fence-agents-gce-4.2.1-129.el8_10.27.noarch.rpm</filename>
          <sum type="sha256">6c7cc982029fa53434bd0e7b14a969afb4e092ec74bbb16edfd1b6417e651757</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>