Cumulus RMP 3.7 Release Notes

Follow

Overview

These release notes support Cumulus RMP 3.7.0, 3.7.1, and 3.7.2 and describe currently available features and known issues.

Cumulus RMP 3.7 supports these features and is available on the Penguin Computing Arctica 4804IP-RMP, the Quanta QuantaMesh T1048-LY4R and CX RMP-T out-of-band switches.

Stay up to Date 

  • Sign in and click Follow above to receive a notification when we update these release notes.
  • Subscribe to our product bulletin mailing list to receive important announcements and updates about issues that arise in our products.
  • Subscribe to our security announcement mailing list to receive alerts whenever we update our software for security issues.

{{table_of_contents}}

What's New in Cumulus RMP 3.7.0

Cumulus RMP 3.7.0 contains several bug fixes and the following new features:

Cumulus RMP 3.7.1 and 3.7.2 contain bug fixes only.

Install or Upgrade to Version 3.7

Whether you are installing Cumulus RMP 3.7 for the first time or upgrading from an earlier version, follow the steps in the Installation Management section of the Cumulus Linux User Guide.

Documentation

You can read the technical documentation here.

Issues Fixed in Cumulus RMP 3.7.2

The following is a list of issues fixed in Cumulus RMP 3.7.2 from earlier versions of Cumulus RMP. 

Release Note ID Summary Description

RN-1082 (CM-22257)
You can add ports as bridge ports multiple times with NCLU

When you add ports as bridge ports multiple times with the NCLU command, the commits succeed without error.

To work around this issue, remove the extra interfaces with the net del bridge bridge ports <interface> command.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1085 (CM-22237)
NCLU SNMP configuration does not start the SNMP server

When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning:

WARNING: snmpd is not running.  Run "journalctl -u snmpd" for error messages.

To work around this issue, start SNMP manually.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1092 (CM-22443)
IEEE 802.1X support for management VRF

Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1130 (CM-22618)
On Cumulus RMP, multiple failed ACL installations result in an `out of table resource` message even after reverting to a good rule set

After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1143 (CM-22631)
Adding MTU to a VLAN adds `mtu` lines for each bridge port even if they are not defined in /etc/network/interfaces

If you add the MTU to a VLAN with the NCLU net add vlan <vlan> mtu <mtu> command, Cumulus Linux adds extra mtu lines in the /etc/network/interfaces file when there are defined bridge ports that do not exist elsewhere in the file.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1156 (CM-22662)
Debian Security Advisory DSA-4314 for net-snmp issues CVE-2018-18065

The following CVEs were announced in Debian Security Advisory DSA-4314-1 and affect the net-snmp package.

This issue is fixed in Cumulus RMP 3.7.2.

------------------------------------------------------------------

Debian Security Advisory DSA-4314-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

October 11, 2018 https://www.debian.org/security/faq

------------------------------------------------------------------

Package : net-snmp

CVE ID : CVE-2018-18065

Debian Bug : 910638

Magnus Klaaborg Stubman discovered a NULL pointer dereference bug in net-snmp, a suite of Simple Network Management Protocol applications, allowing a remote, authenticated attacker to crash the snmpd process (causing a denial of service).

For the stable distribution (stretch), this problem has been fixed in version 5.7.3+dfsg-1.7+deb9u1.

We recommend that you upgrade your net-snmp packages.

For the detailed security status of net-snmp, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/net-snmp

Upstream info and fix are:

https://dumpco.re/blog/net-snmp-5.7.3-remote-dos

https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9bf8c457d/


RN-1173 (CM-22917)
The `poed` service is not enabled by default on PoE platforms in Cumulus Linux 3.7

When installing a Cumulus Linux 3.6.1 through 3.7.1 image, the poed service is not enabled by default.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1180 (CM-22087)
NCLU fails to parse when `link-speed 10` is applied

NCLU does not allow for configuration of link-speed 10 and does not parse any unrelated NCLU configuration when link-speed 10 is detected in the /etc/network/interfaces file.

This issue is fixed in Cumulus RMP 3.7.2.

New Known Issues in Cumulus RMP 3.7.2

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1145 (CM-22560)
Debian Security Advisory DSA-4306-1 for python issues CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802

The following CVEs were announced in Debian Security Advisory DSA-4306-1 and affect the python package.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4306-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 27, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: python3.4

CVE ID: CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802

Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and the shutil module was affected by a command injection vulnerability.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

This issue will be fixed in a future release.


RN-1150 (CM-22891)
Debian Security Advisory DSA-4332-1 for ruby issues CVE-2018-16395 CVE-2018-16396

The following CVEs were announced in Debian Security Advisory DSA-4332-1 and affect the ruby package.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4332-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

November 03, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : ruby2.3

CVE ID : CVE-2018-16395 CVE-2018-16396

Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2018-16395

Tyler Eckstein reported that the equality check of OpenSSL::X509::Name could return true for non-equal objects. If a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal.

CVE-2018-16396

Chris Seaton discovered that tainted flags are not propagated in Array#pack and String#unpack with some directives.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u4.

We recommend that you upgrade your ruby2.3 packages.

For the detailed security status of ruby2.3, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ruby2.3

The 2.1 tracker for jessie is: https://security-tracker.debian.org/tracker/ruby2.1

This issue will be fixed in a future release.


RN-1158 (CM-22609)
Debian Security Advisory DSA-4311-1 for git issues CVE-2018-17456

The following CVEs were announced in Debian Security Advisory DSA-4311-1 and affect the git package.

-------------------------------------------------------------------

Debian Security Advisory DSA-4311-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

October 05, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------

Package : git

CVE ID : CVE-2018-17456

joernchen of Phenoelit discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability via a specially crafted .gitmodules file in a project cloned with --recurse-submodules.

For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u4.

We recommend that you upgrade your git packages.

For the detailed security status of git, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/git

This issue will be fixed in a future release.


RN-1159 (CM-22441)
Debian Security Advisory DSA-4924 for ghostscript issues CVE-2018-16509 CVE-2018-16802 CVE-2018-11645

The following CVEs were announced in Debian Security Advisory DSA-4924-1 and affect the ghostscript package.

----------------------------------------------------------

Debian Security Advisory DSA-4294-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 16, 2018 https://www.debian.org/security/faq

----------------------------------------------------------

Package : ghostscript

CVE ID : CVE-2018-16509 CVE-2018-16802

Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

For the stable distribution (stretch), these problems have been fixed in version 9.20~dfsg-3.2+deb9u5.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ghostscript

This issue will be fixed in a future release.


RN-1160 (CM-22298)
Debian Security Advisory DSA-4286-1 for curl issues CVE-2018-14618

The following CVEs were announced in Debian Security Advisory DSA-4286-1 and affect the curl package.

-------------------------------------------------------------

Debian Security Advisory DSA-4286-1 security@debian.org

https://www.debian.org/security/ Alessandro Ghedini

September 05, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------

Package : curl

CVE ID : CVE-2018-14618

Zhaoyang Wu discovered that cURL, an URL transfer library, contains a buffer overflow in the NTLM authentication code triggered by passwords that exceed 2GB in length on 32bit systems. See https://curl.haxx.se/docs/CVE-2018-14618.html for more information.

For the stable distribution (stretch), this problem has been fixed in version 7.52.1-5+deb9u7.

We recommend that you upgrade your curl packages.

For the detailed security status of curl, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/curl

This issue will be fixed in a future release.


RN-1161 (CM-22937)
NCLU SNMPv3 user configuration does not get applied correctly

NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.

To work around this issue, stop snmpd, remove the cache file, then restart snmpd.

This is a known issue that is currently being investigated.


RN-1165 (CM-22802)
The NCLU `bridge pvid` command does not add the interface to bridge ports

When you run the net add (bond|interface) <iface> bridge pvid command, NCLU does not add the port as a slave of the VLAN-aware bridge.

This is a known issue that is currently being investigated.


RN-1171 (CM-22950)
Debian Security Advisory DSA-4335-1 for nginx issues CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

The following CVEs were announced in Debian Security Advisory DSA-4335-1 and affect the nginx package.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4335-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff November 08, 2018

https://www.debian.org/security/faq

--------------------------------------------------------------------------------------

Package : nginx

CVE ID : CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

Three vulnerabilities were discovered in Nginx, a high-performance web and reverse proxy server, which could in denial of service in processing HTTP/2 (via excessive memory/CPU usage) or server memory disclosure in the ngx_http_mp4_module module (used for server-side MP4 streaming).

For the stable distribution (stretch), these problems have been fixed in version 1.10.3-1+deb9u2.

We recommend that you upgrade your nginx packages.

For the detailed security status of nginx, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/nginx

This issue will be fixed in a future release.


RN-1172 (CM-22346)
Debian Security Advisory DSA-4288-1 for ghostscript issues CVE-2018-15908 CVE-2018-15910 CVE-2018-15911 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585

The following CVEs were announced in Debian Security Advisory DSA-4288-1 and affect the ghostscript package.

-----------------------------------------------------------------

Debian Security Advisory DSA-4288-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 07, 2018 https://www.debian.org/security/faq

------------------------------------------------------------------

Package : ghostscript

CVE ID : CVE-2018-15908 CVE-2018-15910 CVE-2018-15911 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585

Tavis Ormandy discovered multiple vulnerabilities in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

For the stable distribution (stretch), these problems have been fixed in version 9.20~dfsg-3.2+deb9u4.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ghostscript

This issue will be fixed in a future release.


RN-1192 (CM-23075)
Limitation on the number of interfaces supported in the DHCP relay file

There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example,1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:

2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51
2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on   LPF/vlan.101/a0:00:00:00:00:51

Eventually the dhcrelay service stops.

This is a known issue that is currently being investigated.

New Known Issues in Cumulus RMP 3.7.1

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1130 (CM-22618)
On Cumulus RMP, multiple failed ACL installations result in an `out of table resource` message even after reverting to a good rule set

After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules.

This is a known issue that is currently being investigated.


RN-1133 (CM-22590)
NCLU `net show configuration commands` does not show output for an IPv6 rsyslog host

NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts.

This is a known issue that is currently being investigated.


RN-1134 (CM-22589)
NCLU `net show configuration commands` displays a syslog command with invalid syntax

NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:

cumulus@switch:~$ net add syslog host ipv4 10.0.0.1 port udp 514
cumulus@switch:~$ net commit

then run net show configuration commands, the output of the command syntax is invalid.

This is a known issue that is currently being investigated.


RN-1136 (CM-22554)
The link state of a bond is not updated when several members are brought down remotely at once

If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces does not correctly transition to the down state; however, all links show down in hardware.

This is a known issue that is currently being investigated.

Issues Fixed in Cumulus RMP 3.7.0

The following is a list of issues fixed in Cumulus RMP 3.7.0 from earlier versions of Cumulus RMP. 

Release Note ID Summary Description

RN-1040 (CM-22120)
Link down does not work on an Ethernet interface configured in the management VRF

The link-down yes configuration in the /etc/network/interfaces file does not work for the eth0 or eth1 interface configured in the management VRF. This issue is not observed if the Ethernet interface is in the default VRF.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1041 (CM-21890)
Debian Security Advisory DSA-4259 for Ruby issues CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000073

The following CVEs were announced in Debian Security Advisory DSA-4259-1 and affect the ruby2.3 package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4259-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

July 31, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: ruby2.3

CVE ID: CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure.

This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u3.

We recommend that you upgrade your ruby2.3 packages.

Note: CVE-2018-1000073 and CVE-2018-1000074 are awaiting re-analysis.

For the detailed security status of ruby2.3, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby2.3


RN-1043 (CM-22066)
NCLU commands hang without response

When you run an NCLU command from the command line, the command hangs without a response.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1049 (CM-22161)
The ptmd shell environment variables are not being set correctly

When the ptmd daemon detects an LLDP neighbor change event, the respective script is executed (if-topo-pass or if-topo-fail). Environment variables are set and are accessible to the script (as described in man ptmd). However, in LLDP events, some environment variables are not getting set correctly.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1050 (CM-22146)
Repeating an existing SNMP v3 user returns wrong exit code

If SNMP is configured, entering the NCLU command to create an SNMP v3 user that already exists returns an exit code of 1.

To work around this issue, delete the username with net del snmp-server username <username> command before adding it again.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1056 (CM-22147)
Debian Security Advisory DSA-4280-1 for openssh issues CVE-2018-15473

The following CVEs were announced in Debian Security Advisory DSA-4280-1 and affect the openssh package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4280-1 security@debian.org

https://www.debian.org/security/ Sebastien Delafond

August 22, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : openssh

CVE ID : CVE-2018-15473

Debian Bug : 906236

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.

For the stable distribution (stretch), this problem has been fixed in version 1:7.4p1-10+deb9u4.

We recommend that you upgrade your openssh packages.

For the detailed security status of openssh, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh


RN-1057 (CM-21619)
Security: ntp issues CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185

The following CVEs affect ntp.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Ubuntu Security Notice USN-3707-1

July 09, 2018

ntp vulnerabilities

-------------------------------------------------------------------------

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.04 LTS

Ubuntu 17.10

Ubuntu 16.04 LTS

Ubuntu 14.04 LTS

Summary: Several security issues were fixed in NTP.

Software Description: ntp: Network Time Protocol daemon and utility programs

Details:

Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7184)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2018-7185)

Update instructions: The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS: ntp 1:4.2.8p10+dfsg-5ubuntu7.1

Ubuntu 17.10: ntp 1:4.2.8p10+dfsg-5ubuntu3.3

Ubuntu 16.04 LTS: ntp 1:4.2.8p4+dfsg-3ubuntu5.9

Ubuntu 14.04 LTS: ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13

In general, a standard system update will make all the necessary changes.

References: https://usn.ubuntu.com/usn/usn-3707-1

CVE-2018-7182, CVE-2018-7183, CVE-2018-7184, CVE-2018-7185


RN-1059 (CM-21939)
Debian Security Advisory DSA-4266-1 for kernel issues CVE-2018-13405

The following CVEs were announced in Debian Security Advisory DSA-4266-1 and affect the kernel.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian shows the CVE-2018-13405 details, including link to the kernel.org fix here: https://security-tracker.debian.org/tracker/CVE-2018-13405.

The kernel.org fix is here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7

Debian has the CVE-2018-5390 TCP DoS info here: https://security-tracker.debian.org/tracker/CVE-2018-5390.

CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') - CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. An attacker can induce a denial of service condition by sending specially modified packets within ongoing TCP sessions. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port. Thus, the attacks cannot be performed using spoofed IP addresses.

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e


RN-1060 (CM-22016)
Debian Security Advisor DSA-4269-1 for postgresql issues CVE-2018-10915 CVE-2018-10925

The following CVEs were announced in Debian Security Advisory DSA-4269-1 and affect the postgresql package.

CVE-2018-10925 is fixed in Cumulus RMP 3.7.0. CVE-2018-10915 will be fixed when it's fixed upstream.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4269-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

August 10, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : postgresql-9.6

CVE ID : CVE-2018-10915 CVE-2018-10925

Two vulnerabilities have been found in the PostgreSQL database system:

CVE-2018-10915

Andrew Krasichkov discovered that libpq did not reset all its connection state during reconnects.

CVE-2018-10925

It was discovered that some "CREATE TABLE" statements could disclose server memory.

For additional information, refer to the upstream announcement at https://www.postgresql.org/about/news/1878/

For the detailed security status of postgresql-9.6, refer to its security tracker page at: https://security-tracker.debian.org/tracker/postgresql-9.6

https://security-tracker.debian.org/tracker/source-package/postgresql-9.4

https://security-tracker.debian.org/tracker/CVE-2018-10915

https://security-tracker.debian.org/tracker/CVE-2018-10925

CVE-2018-10925 is listed as fixed in jessie source package: 9.4.19-0+deb8u1


RN-1061 (CM-22203)
The HTTP API enabled and listening by default

By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1111 (CM-21804)
`mstpd` prints unnecessary `bridge_notify: port ##: no_flush 0` log when there is a netlink link event

Whenever there is a netlink link event, mstpd prints an additional log: bridge_notify: port 65: no_flush 0 where 65 is the ifIndex. There are already clear logs when there is a link transition; this log is not necessary.

This issue is fixed in Cumulus RMP 3.7.0.

Known Issues in Cumulus RMP 3.7.0

The following known issues affect the current release.

Release Note ID Summary Description

RN-602 (CM-15094)
sFlow interface speed incorrect in counter samples

Counter samples exported from the switch show an incorrect interface speed.

This is a known issue that is currently being investigated.


RN-754 (CM-15812)
Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs

Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs.

This is a known issue that is currently being investigated.


RN-755 (CM-16855)
Auto-negotiation ON sometimes results in NO-CARRIER

If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.

To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary.


RN-758 (CM-17557)
If sFlow is enabled, some sampled packets (such as multicast) are forwarded twice

When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack).

This is a known issue that is currently being investigated.


RN-760 (CM-18682)
smonctl utility JSON parsing error

There is a parsing error with the smonctl utility. In some cases when JSON output is chosen, the smonctl utility crashes. The JSON output is necessary to make the information available through SNMP.

This is a known issue that is currently being investigated.


RN-788 (CM-19381)
dhcrelay does not bind to interfaces that have names longer than 14 characters

The dhcrelay command does not bind to an interface if the interface's name is longer than 14 characters.

To work around this issue, change the interface name to be 14 or fewer characters if dhcrelay is required to bind to it.

This is a known issue that is currently being investigated.


RN-822 (CM-19788)
Using the same VLAN ID on a subinterface and bridge VIDs for a given port is not easily corrected

If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface.

This is a known issue that is currently being investigated.


RN-823 (CM-19724)
Multicast control protocols are classified to the bulk queue by default

PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7.

This is a known issue that is currently being investigated.


RN-948 (CM-17494)
The default arp_ignore mode does not prevent reachable neighbor entries for hosts not on the connected subnet

In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.

To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information.


RN-1039 (CM-22045)
SNMPv3 Trap passwords and encryption keys longer then 16 characters might cause snmpd to core dump

SNMPv3 TRAP passwords or encryption keys longer then 16 characters might result in a core dump. For example:

net add snmp-server trap-destination 3.3.3.3 username 
verlongtrapusername auth-md5 verylongmd52345678901234567890 
encrypt-aes verylongencrypt567890123456789012345678 
engine-id 0x80001f8880f49b75319690895b00000000

# this results in a core dump:
root@cel-redxp-01:/home/cumulus# systemctl status  snmpd
   snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
   Loaded: loaded (/lib/systemd/system/snmpd.service; enabled)
   Active: failed (Result: core-dump) since Wed 2018-09-05 16:18:05 UTC; 1min 25s ago
  Process: 21163 ExecStart=/usr/sbin/snmpd $SNMPDOPTS -f (code=dumped, signal=SEGV)
 Main PID: 21163 (code=dumped, signal=SEGV)
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..

Sep 05 16:18:05 cel-redxp-01 systemd[1]: snmpd.service: main process exited, code=dumped, status=11/SEGV
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Unit snmpd.service entered failed state.

To work around this issue, use SNMPv3 TRAP passwords and encryption keys that are 16 characters or shorter.

This is a known issue that is currently being investigated.


RN-1071 (CM-22345)
Redirected traffic increments the INPUT ACL rule counter but does not perform an action

If a packet to an unknown IP address (but known network) enters the switch and matches an INPUT ACL rule, it is redirected  for ARP and the counters increment for that rule, but it does not perform the action. This only happens until the ARP reply is sent, and then the traffic is forwarded properly.

To work around this issue, change the rules to INPUT,FORWARD instead of INPUT. Drops should then be logged properly.

This is a known issue that is currently being investigated.


RN-1074 (CM-22145)
The `net show configuration files` command does not include /etc/restapi.conf

The /etc/restapi.conf file is not listed in the net show configuration files command output.

This is a known issue that is currently being investigated.


RN-1082 (CM-22257)
You can add ports as bridge ports multiple times with NCLU

When you add ports as bridge ports multiple times with the NCLU cmmand, the commits succeed without error.

To work around this issue, remove the extra interfaces with the net del bridge bridge ports <interface> command.

This is a known issue that is currently being investigated.


RN-1085 (CM-22237)
NCLU SNMP configuration does not start the SNMP server

When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning:

WARNING: snmpd is not running.  Run "journalctl -u snmpd" for error messages.

To work around this issue, start SNMP manually.

This is a known issue that is currently being investigated.


RN-1092 (CM-22443)
IEEE 802.1X support for management VRF

Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed.

This issue is currently being investigated.


RN-1095 (CM-21813)
The NCLU `net add` and `net commit` commands edit the interfaces file even when the interface configuration is not changed

The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes.

This issue is currently being investigated.

Have more questions? Submit a request

Comments

Powered by Zendesk