After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules.

This is a known issue that is currently being investigated.

NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts.

This is a known issue that is currently being investigated.

NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:

cumulus@switch:~$ net add syslog host ipv4 10.0.0.1 port udp 514
cumulus@switch:~$ net commit

then run net show configuration commands, the output of the command syntax is invalid.

This is a known issue that is currently being investigated.

If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces does not correctly transition to the down state; however, all links show down in hardware.

This is a known issue that is currently being investigated.

The link-down yes configuration in the /etc/network/interfaces file does not work for the eth0 or eth1 interface configured in the management VRF. This issue is not observed if the Ethernet interface is in the default VRF.

This issue is fixed in Cumulus RMP 3.7.0.

The following CVEs were announced in Debian Security Advisory DSA-4259-1, and affect the ruby2.3 package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4259-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

July 31, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: ruby2.3

CVE ID: CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure.

This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u3.

We recommend that you upgrade your ruby2.3 packages.

Note: CVE-2018-1000073 and CVE-2018-1000074 are awaiting re-analysis.

For the detailed security status of ruby2.3, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby2.3

When you run an NCLU command from the command line, the command hangs without a response.

This issue is fixed in Cumulus RMP 3.7.0.

When the ptmd daemon detects an LLDP neighbor change event, the respective script is executed (if-topo-pass or if-topo-fail). Environment variables are set and are accessible to the script (as described in man ptmd). However, in LLDP events, some environment variables are not getting set correctly.

This issue is fixed in Cumulus RMP 3.7.0.

If SNMP is configured, entering the NCLU command to create an SNMP v3 user that already exists returns an exit code of 1.

To work around this issue, delete the username with net del snmp-server username <username> command before adding it again.

This issue is fixed in Cumulus RMP 3.7.0.

The following CVEs were announced in Debian Security Advisory DSA-4280-1, and affect the openssh package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4280-1 security@debian.org

https://www.debian.org/security/ Sebastien Delafond

August 22, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : openssh

CVE ID : CVE-2018-15473

Debian Bug : 906236

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.

For the stable distribution (stretch), this problem has been fixed in version 1:7.4p1-10+deb9u4.

We recommend that you upgrade your openssh packages.

For the detailed security status of openssh, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh

The following CVEs affect ntp.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Ubuntu Security Notice USN-3707-1

July 09, 2018

ntp vulnerabilities

-------------------------------------------------------------------------

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.04 LTS

Ubuntu 17.10

Ubuntu 16.04 LTS

Ubuntu 14.04 LTS

Summary: Several security issues were fixed in NTP.

Software Description: ntp: Network Time Protocol daemon and utility programs

Details:

Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7184)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2018-7185)

Update instructions: The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS: ntp 1:4.2.8p10+dfsg-5ubuntu7.1

Ubuntu 17.10: ntp 1:4.2.8p10+dfsg-5ubuntu3.3

Ubuntu 16.04 LTS: ntp 1:4.2.8p4+dfsg-3ubuntu5.9

Ubuntu 14.04 LTS: ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13

In general, a standard system update will make all the necessary changes.

References: https://usn.ubuntu.com/usn/usn-3707-1

CVE-2018-7182, CVE-2018-7183, CVE-2018-7184, CVE-2018-7185

The following CVEs were announced in Debian Security Advisory DSA-4266-1, and affect the kernel.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian shows the CVE-2018-13405 details, including link to the kernel.org fix here: https://security-tracker.debian.org/tracker/CVE-2018-13405.

The kernel.org fix is here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7

Debian has the CVE-2018-5390 TCP DoS info here: https://security-tracker.debian.org/tracker/CVE-2018-5390.

CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') - CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. An attacker can induce a denial of service condition by sending specially modified packets within ongoing TCP sessions. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port. Thus, the attacks cannot be performed using spoofed IP addresses.

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e

The following CVEs were announced in Debian Security Advisory DSA-4269-1 and affect the postgresql package.

CVE-2018-10925 is fixed in Cumulus RMP 3.7.0. CVE-2018-10915 will be fixed when it's fixed upstream.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4269-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

August 10, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : postgresql-9.6

CVE ID : CVE-2018-10915 CVE-2018-10925

Two vulnerabilities have been found in the PostgreSQL database system:

CVE-2018-10915

Andrew Krasichkov discovered that libpq did not reset all its connection state during reconnects.

CVE-2018-10925

It was discovered that some "CREATE TABLE" statements could disclose server memory.

For additional information, refer to the upstream announcement at https://www.postgresql.org/about/news/1878/

For the detailed security status of postgresql-9.6, refer to its security tracker page at: https://security-tracker.debian.org/tracker/postgresql-9.6

https://security-tracker.debian.org/tracker/source-package/postgresql-9.4

https://security-tracker.debian.org/tracker/CVE-2018-10915

https://security-tracker.debian.org/tracker/CVE-2018-10925

CVE-2018-10925 is listed as fixed in jessie source package: 9.4.19-0+deb8u1

By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests.

This issue is fixed in Cumulus RMP 3.7.0.

Whenever there is a netlink link event, mstpd prints an additional log: bridge_notify: port 65: no_flush 0 where 65 is the ifIndex. There are already clear logs when there is a link transition; this log is not necessary.

This issue is fixed in Cumulus RMP 3.7.0.

Counter samples exported from the switch show an incorrect interface speed.

This is a known issue that is currently being investigated.

Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs.

This is a known issue that is currently being investigated.

If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.

To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary.

When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack).

This is a known issue that is currently being investigated.

There is a parsing error with the smonctl utility. In some cases when JSON output is chosen, the smonctl utility crashes. The JSON output is necessary to make the information available through SNMP.

This is a known issue that is currently being investigated.

The dhcrelay command does not bind to an interface if the interface's name is longer than 14 characters.

To work around this issue, change the interface name to be 14 or fewer characters if dhcrelay is required to bind to it.

This is a known issue that is currently being investigated.

If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface.

This is a known issue that is currently being investigated.

PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7.

This is a known issue that is currently being investigated.

In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.

To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information.

SNMPv3 TRAP passwords or encryption keys longer then 16 characters might result in a core dump. For example:

net add snmp-server trap-destination 3.3.3.3 username 
verlongtrapusername auth-md5 verylongmd52345678901234567890 
encrypt-aes verylongencrypt567890123456789012345678 
engine-id 0x80001f8880f49b75319690895b00000000

# this results in a core dump:
root@cel-redxp-01:/home/cumulus# systemctl status  snmpd
   snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
   Loaded: loaded (/lib/systemd/system/snmpd.service; enabled)
   Active: failed (Result: core-dump) since Wed 2018-09-05 16:18:05 UTC; 1min 25s ago
  Process: 21163 ExecStart=/usr/sbin/snmpd $SNMPDOPTS -f (code=dumped, signal=SEGV)
 Main PID: 21163 (code=dumped, signal=SEGV)
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..

Sep 05 16:18:05 cel-redxp-01 systemd[1]: snmpd.service: main process exited, code=dumped, status=11/SEGV
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Unit snmpd.service entered failed state.

To work around this issue, use SNMPv3 TRAP passwords and encryption keys that are 16 characters or shorter.

This is a known issue that is currently being investigated.

If a packet to an unknown IP address (but known network) enters the switch and matches an INPUT ACL rule, it is redirected  for ARP and the counters increment for that rule, but it does not perform the action. This only happens until the ARP reply is sent, and then the traffic is forwarded properly.

To work around this issue, change the rules to INPUT,FORWARD instead of INPUT. Drops should then be logged properly.

This is a known issue that is currently being investigated.

The /etc/restapi.conf file is not listed in the net show configuration files command output.

This is a known issue that is currently being investigated.

When you add ports as bridge ports multiple times with the NCLU cmmand, the commits succeed without error.

To work around this issue, remove the extra interfaces with the net del bridge bridge ports <interface> command.

This is a known issue that is currently being investigated.

When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning:

WARNING: snmpd is not running.  Run "journalctl -u snmpd" for error messages.

To work around this issue, start SNMP manually.

This is a known issue that is currently being investigated.

Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed.

This issue is currently being investigated.

The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes.

This issue is currently being investigated.