CERT24RHSA-2026:13672 — Red Hat Security Advisory: fence-agents security updateLoading data…
CERT24Threat Observatory
Period

RHSA-2026:13672 — Red Hat Security Advisory: fence-agents security update

The source describes a fence-agents security update and two validation flaws in related Python libraries. A missing validation step in the python cryptography package allows an attacker to provide a public-key point from a small-order subgroup. This can affect ECDH shared-key negotiation and ECDSA signature verification; only SECT curves are impacted. PyJWT does not validate the JWS crit header parameter and may accept a token whose crit array lists extensions it does not understand, although RFC 7515 requires rejection.

← Back to intelligence

RHSA-2026:13672 — Red Hat Security Advisory: fence-agents security update

The source describes a fence-agents security update and two validation flaws in related Python libraries. A missing validation step in the python cryptography package allows an attacker to provide a public-key point from a small-order subgroup. This can affect ECDH shared-key negotiation and ECDSA signature verification; only SECT curves are impacted. PyJWT does not validate the JWS crit header parameter and may accept a token whose crit array lists extensions it does not understand, although RFC 7515 requires rejection.