Cumulus RMP 3.7 Release Notes

Follow

Overview

These release notes support Cumulus RMP 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, and 3.7.6 and describe currently available features and known issues.

Cumulus RMP 3.7 supports these features and is available on the Penguin Computing Arctica 4804IP-RMP, the Quanta QuantaMesh T1048-LY4R and CX RMP-T out-of-band switches.

Stay up to Date 

  • Sign in and click Follow above to receive a notification when we update these release notes.
  • Subscribe to our product bulletin mailing list to receive important announcements and updates about issues that arise in our products.
  • Subscribe to our security announcement mailing list to receive alerts whenever we update our software for security issues.

{{table_of_contents}}

What's New in Cumulus RMP 3.7

Cumulus RMP 3.7.1, 3.7.2, 3.7.3, 3.7.4, and 3.7.5 contain bug fixes only. Cumulus RMP 3.7.6 has no new fixes.

Cumulus RMP 3.7.4 is no longer available due to severe issues that are resolved in Cumulus RMP 3.7.5.

Cumulus RMP 3.7.0 contains several bug fixes and the following new features:

 

Install or Upgrade to Version 3.7

Whether you are installing Cumulus RMP 3.7 for the first time or upgrading from an earlier version, follow the steps in the Installation Management section of the Cumulus Linux User Guide.

Documentation

You can read the technical documentation here.

New Known Issues in Cumulus RMP 3.7.6

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1384 (CM-24805)
Debian Security Advisory DSA-4436-1 for imagemagick CVE-2019-9956 CVE-2019-10650

The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4436-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

April 28, 2019 https://www.debian.org/security/faq

------------------------------------------------------------------------------------------

This update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed.

For the stable distribution (stretch), these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u7.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/imagemagick


RN-1385 (CM-23636)
Debian Security Advisory DSA 4371-1 for apt CVE-2019-3462

The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4371-1 security@debian.org

https://www.debian.org/security/ Yves-Alexis Perez

January 22, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Max Justicz discovered a vulnerability in APT, the high level package manager.

The code handling HTTP redirects in the HTTP transport method doesn't properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using:

apt -o Acquire::http::AllowRedirect=false update

apt -o Acquire::http::AllowRedirect=false upgrade

The code handling HTTP redirects in the HTTP transport method doesn't properly sanitize fields transmitted over the wire.

This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using:

apt -o Acquire::http::AllowRedirect=false update

apt -o Acquire::http::AllowRedirect=false upgrade

This is known to break some proxies when used against security.debian.org. If that happens, people can switch their security APT source to use deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main

For the stable distribution (stretch), this problem has been fixed in version 1.4.9.


RN-1390 (CM-24645)
Debian Security Advisory DSA-4433-1 for ruby2.3 CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325

The following CVEs were announced in Debian Security Advisory DSA-4433-1 and affect the ruby2.3 package.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4433-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

April 16, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Package : ruby2.3

CVE ID : CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323

CVE-2019-8324 CVE-2019-8325

Several vulnerabilities have been discovered in the Rubygems included in the interpreter for the Ruby language, which may result in denial of service or the execution of arbitrary code.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u6.

We recommend that you upgrade your ruby2.3 packages.

For the detailed security status of ruby2.3, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ruby2.3


RN-1391 (CM-24644)
Debian Security Advisory DSA-4432-1 for ghostscript CVE-2019-3835 CVE-2019-3838

The following CVEs were announced in Debian Security Advisory DSA-4432-1 and affect the ghostscript package.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4432-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

April 16, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Package : ghostscript

CVE ID : CVE-2019-3835 CVE-2019-3838

Debian Bug : 925256 925257

Cedric Buissart discovered two vulnerabilities in Ghostscript, the GPL PostScript/PDF interpreter, which could result in bypass of file system restrictions of the dSAFER sandbox.

For the stable distribution (stretch), these problems have been fixed in version 9.26a~dfsg-0+deb9u2.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ghostscript


RN-1392 (CM-24530)
Debian Security Advisory DSA-4428-1 for systemd CVE-2019-3842

The following CVEs were announced in Debian Security Advisory DSA-4428-1 and affect the systemd package.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4428-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

April 08, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Package : systemd

CVE ID : CVE-2019-3842

Jann Horn discovered that the PAM module in systemd insecurely uses the environment and lacks seat verification permitting spoofing an active session to PolicyKit. A remote attacker with SSH access can take advantage of this issue to gain PolicyKit privileges that are normally only granted to clients in an active session on the local console.

For the stable distribution (stretch), this problem has been fixed in version 232-25+deb9u11.

This update includes updates previously scheduled to be released in the stretch 9.9 point release.

We recommend that you upgrade your systemd packages.

For the detailed security status of systemd, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/systemd


RN-1393 (CM-24510)
Debian Security Advisory DSA-4425-1 for wget CVE-2019-5953

The following CVEs were announced in Debian Security Advisory DSA-4425-1 and affect the wget package.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4425-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

April 05, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Package : wget

CVE ID : CVE-2019-5953

Debian Bug : 926389

Kusano Kazuhiko discovered a buffer overflow vulnerability in the handling of Internationalized Resource Identifiers (IRI) in wget, a network utility to retrieve files from the web, which could result in the execution of arbitrary code or denial of service when recursively downloading from an untrusted server.

For the stable distribution (stretch), this problem has been fixed in version 1.18-5+deb9u3.

We recommend that you upgrade your wget packages.

For the detailed security status of wget, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/wget


RN-1394 (CM-24357)
Debian Security Advisory DSA-4416-1 for wireshark CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 CVE-2019-9208 CVE-2019-9209 CVE-2019-9214

The following CVEs were announced in Debian Security Advisory DSA-4416-1 and affect the wireshark package.

-------------------------------------------------------------------------------------------

Debian Security Advisory DSA-4416-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

March 24, 2019 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------------

Package: wireshark

CVE ID: CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 CVE-2019-9208

CVE-2019-9209 CVE-2019-9214

Debian Bug: 923611

It was discovered that Wireshark, a network traffic analyzer, contained several vulnerabilities in the dissectors for 6LoWPAN, P_MUL, RTSE, ISAKMP, TCAP, ASN.1 BER and RPCAP, which could result in denial of service.

For the stable distribution (stretch), these problems have been fixed in version 2.6.7-1~deb9u1.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/wireshark


RN-1399 (CM-23952)
ifupdown2 user policy overrides do not apply if multiple files reference same module

If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply.

This is a known issue that is currently being investigated.


RN-1405 (CM-24618)
Apostrophe in interface alias causes netd failure

If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:

ERROR: No closing quotation
See /var/log/netd.log for more details.

This is a known issue that is currently being investigated.


RN-1410 (CM-24824)
DHCP relay crashes with -nl flag when the server returns an offer

The dhcrelay service crashes when the DHCP relay packet comes back from the server.

To work around this issue, remove the --nl flag from the dhcrelay service.

This is a known issue that is currently being investigated.

Issues Fixed in Cumulus RMP 3.7.5

The following is a list of issues fixed in Cumulus RMP 3.7.5 from earlier versions of Cumulus Linux.

Release Note ID Summary Description

RN-1355 (CM-23829)
Debian Security Advisory DSA-4387-1 and -2 for openssh CVE-2018-20685 CVE-2019-6109 CVE-2019-6111

The following CVEs were announced in Debian Security Advisory DSA-4387-1 and affect the openssh package.

This issue is fixed in Cumulus RMP 3.7.5.

---------------------------------------------------------------------------------------

Debian Security Advisory DSA-4387-1 security@debian.org

https://www.debian.org/security/ Yves-Alexis Perez

February 09, 2019 https://www.debian.org/security/faq

----------------------------------------------------------------------------------------

Package: openssh

CVE ID: CVE-2018-20685 CVE-2019-6109 CVE-2019-6111

Debian Bug: 793412 919101

Harry Sintonen from F-Secure Corporation discovered multiple vulnerabilities in OpenSSH, an implementation of the SSH protocol suite. All the vulnerabilities are in found in the scp client implementing the SCP protocol.

CVE-2018-20685

Due to improper directory name validation, the scp client allows servers tovmodify permissions of the target directory by using empty or dotvdirectory name.

CVE-2019-6109

Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.

CVE-2019-6111

Due to scp client insufficient input validation in path names sent by server, a malicious server can do arbitrary file overwrites in target directory. If the recursive (-r) option is provided, the server can also manipulate subdirectories as well.

The check added in this version can lead to regression if the client and the server have differences in wildcard expansion rules. If the server is trusted for that purpose, the check can be disabled with a new -T option to the scp client.

For the stable distribution (stretch), these problems have been fixed in version 1:7.4p1-10+deb9u5.

We recommend that you upgrade your openssh packages.

For the detailed security status of openssh please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/openssh


RN-1368 (CM-24043)
Debian Security Advisory DSA-4400-1 for openssl CVE-2019-1559

The following CVEs were announced in Debian Security Advisory DSA-4400-1 and affect the openssl package.

This issue is fixed in Cumulus RMP 3.7.5.

---------------------------------------------------------------------------------------

Debian Security Advisory DSA-4400-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

February 28, 2019 https://www.debian.org/security/faq

----------------------------------------------------------------------------------------

Package : openssl1.0

CVE ID : CVE-2019-1559

Juraj Somorovsky, Robert Merget and Nimrod Aviram discovered a padding oracle attack in OpenSSL.

For the stable distribution (stretch), this problem has been fixed in version 1.0.2r-1~deb9u1.

We recommend that you upgrade your openssl1.0 packages.

For the detailed security status of openssl1.0, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/openssl1.0

https://security-tracker.debian.org/tracker/CVE-2019-1559

Issues Fixed in Cumulus RMP 3.7.4

The following is a list of issues fixed in Cumulus RMP 3.7.4 from earlier versions of Cumulus Linux.

Release Note ID Summary Description

RN-1203 (CM-23535)
Debian Security Advisory DSA-4367-1 for systemd CVE-2018-16865

The following CVEs were announced in Debian Security Advisory DSA-4367-1 and affect the systemd package.

This issue is fixed in Cumulus RMP 3.7.4.

-----------------------------------------------------------------------------------

Debian Security Advisory DSA-4367-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

January 13, 2019 https://www.debian.org/security/faq

-----------------------------------------------------------------------------------

Package: systemd

CVE ID: CVE-2018-16864 CVE-2018-16865 CVE-2018-16866

Debian Bug: 918841 918848

The Qualys Research Labs discovered multiple vulnerabilities in systemd-journald. Two memory corruption flaws, via attacker-controlled alloca()s (CVE-2018-16864, CVE-2018-16865) and an out-of-bounds read flaw leading to an information leak (CVE-2018-16866), could allow an attacker to cause a denial of service or the execution of arbitrary code.

Further details in the Qualys Security Advisory at https://www.qualys.com/2019/01/09/system-down/system-down.txt

For the stable distribution (stretch), these problems have been fixed in version 232-25+deb9u7.

We recommend that you upgrade your systemd packages.

For the detailed security status of systemd, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/system.


RN-1251 (CM-23701)
cl-acltool fails to install multiple rules as ordered set

ACL install is sensitive to the ordering of the LOG/DROP rules. For example, an ACL policy.d file containing only the following:

[iptables]

-A FORWARD -s 192.0.2.10,192.0.2.11 -j LOG
-A FORWARD -s 192.0.2.10,192.0.2.11 -j DROP

fails to install with the following error message from cl-acltool -i:

error: hw sync failed (Cannot process iptables,FORWARD,78,Rule with LOG must be followed by same rule with DROP)

This happens because cl-acltool internally expands the two rules in the wrong order.

This issue is fixed in Cumulus RMP 3.7.4.


RN-1252 (CM-23700)
cl-acltool does not install LOG rules if the source or destination has multiple comma-separated prefixes

cl-acltool -i fails to install LOG rules if either the source or destination (-d or -s) has multiple comma-separated values, such as:

-A FORWARD -s "192.168.0.0/16" -d "192.168.0.0/16,172.16.0.0/12" -j LOG --log-prefix "DROP: "
-A FORWARD -s "192.168.0.0/16" -d "192.168.0.0/16,172.16.0.0/12" -j DROP

You see errors similar to the following:

error: hw sync failed (Cannot process iptables,FORWARD,46,Rule with LOG must be followed by same rule with DROP)
error: hw sync failed (Cannot process ip6tables,FORWARD,30,Rule with LOG must be followed by same rule with DROP)

This issue is fixed in Cumulus RMP 3.7.4.


RN-1336 (CM-22572)
Debian Security Issue for the Linux kernel CVE-2018-17182

The following CVEs were announced and affect the Linux kernel:

https://security-tracker.debian.org/tracker/CVE-2018-17182 for debian.

This issue is fixed in Cumulus RMP 3.7.4.


RN-1337 (CM-24093)
Logs do not describe which value failed to parse

Currently if the BMC firmware encounters a value that it cannot parse, it logs the following message, which provides insufficient data to understand which value failed to parse correctly and, therefore, how to further investigate the issue.

2012-01-10T20:41:58.694892+09:00 spc-1am09-1-fb02 bmcd: unparsible sensor value "FAULT ALARM"
2012-01-12T07:08:33.694504+09:00 spc-1am09-1-fb02 bmcd: unparsible sensor value "FAULT ALARM"
2012-01-13T17:51:58.695336+09:00 spc-1am09-1-fb02 bmcd: unparsible sensor value "FAULT ALARM"
2012-01-13T19:31:03.692842+09:00 spc-1am09-1-fb02 bmcd: unparsible sensor value "FAULT ALARM" 

This issue is fixed in Cumulus RMP 3.7.4.


RN-1339 (CM-23847)
10/25g port limit error in syslog not clear

On the platforms that require a port block to be configured as a set of 10G or 25G, if you do not configure the entire set, for example:

1=10G
2=25G
3=25G
4=10G

when you restart switchd, the service restarts and Cumulus Linux logs an error message into /var/log/switchd.log that is not clear.

This issue is fixed in Cumulus RMP 3.7.4.


RN-1340 (CM-23920)
Debian Security Advisory DSA-4393-1 for systemd CVE-2019-6454

The following CVEs were announced in Debian Security Advisory DSA-4393-1 and affect the systemd package.

This issue is fixed in Cumulus RMP 3.7.4.

----------------------------------------------------------------------------------

Debian Security Advisory DSA-4393-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

February 18, 2019 https://www.debian.org/security/faq

----------------------------------------------------------------------------------

Package : systemd

CVE ID : CVE-2019-6454

Chris Coulson discovered a flaw in systemd leading to denial of service.

An unprivileged user could take advantage of this issue to crash PID1 by sending a specially crafted D-Bus message on the system bus.

For the stable distribution (stretch), this problem has been fixed inversion 232-25+deb9u9.

We recommend that you upgrade your systemd packages.

For the detailed security status of systemd please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/systemd


RN-1341 (CM-23793)
Debian Security Advisory DSA 4386-1 for curl CVE-2018-16890 CVE-2019-3822 CVE-2019-3823

The following CVEs were announced in Debian Security Advisory DSA-4386-1 and affect the curl package.

This issue is fixed in Cumulus RMP 3.7.4.

----------------------------------------------------------------------------------

Debian Security Advisory DSA-4386-1 security@debian.org

https://www.debian.org/security/ Alessandro Ghedini

February 06, 2019 https://www.debian.org/security/faq

----------------------------------------------------------------------------------

Package : curl

CVE ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823

Multiple vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2018-16890

Wenxiang Qian of Tencent Blade Team discovered that the function handling incoming
NTLM type-2 messages does not validate incoming data correctly and is subject to an
integer overflow vulnerability, which could lead to an out-of-bounds buffer read.

CVE-2019-3822

Wenxiang Qian of Tencent Blade Team discovered that the function creating an outgoing
NTLM type-3 header is subject to an integer overflow vulnerability, which could lead to
an out-of-bounds write.

CVE-2019-3823

Brian Carpenter of Geeknik Labs discovered that the code handling the end-of-response for
SMTP is subject to an out-of-bounds heap read.

For the stable distribution (stretch), these problems have been fixed in version 7.52.1-5+deb9u9.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/curl

Issues Fixed in Cumulus RMP 3.7.3

The following is a list of issues fixed in Cumulus RMP 3.7.3 from earlier versions of Cumulus Linux.

Release Note ID Summary Description

RN-885 (CM-20530)
NCLU 'net show interface' command shows 'NotConfigured' for unnumbered interfaces

When an interface is configured for OSPF/BGP unnumbered, the
net show interface command shows NotConfigured instead of showing
that it is unnumbered.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1095 (CM-21813)
The NCLU `net add` and `net commit` commands edit the interfaces file even when the interface configuration is not changed

The NCLU net add and net commit commands change the interfaces file even
if you add a service like snmp/hostname/etc. This causes an issue with automation.
For example, Ansible runs handlers (ifreload -a for interfaces) during each push if
the file being edited changes.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1134 (CM-22589)
NCLU `net show configuration commands` displays a syslog command with invalid syntax

NCLU net show configuration commands displays a net add syslog command
with invalid syntax. For example, if you run the following commands:

cumulus@switch:~$  net add syslog host ipv4 10.0.0.1 port udp 514
cumulus@switch:~$  net commit

then run net show configuration commands, the output of the command syntax is
invalid.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1142 (CM-22657)
The NCLU `net show counters json` command fails with an error

When you run the net show counters json command, you see the following error if any value is 'Unknown':

ERROR: Execution of the command failed. 
"/usr/cumulus/bin/cl-netstat -j" failed. 
Traceback (most recent call last): 
File "/usr/cumulus/bin/cl-netstat", line 292, in <module> 
cnstat_diff_print(cnstat_dict, cnstat_cached_dict, use_json) 
File "/usr/cumulus/bin/cl-netstat", line 135, in cnstat_diff_print 
print table_as_json(table) 
File "/usr/cumulus/bin/cl-netstat", line 62, in table_as_json 
header[3] : int(line[3]), 
ValueError: invalid literal for int() with base 10: 'Unknown'

To work around this issue, run the following command to clear out the semaphore file created by cl-netstat -c:

cumulus@switch:~$  rm /tmp/cl-netstat-$UID/$UID

This issue is fixed in Cumulus RMP 3.7.3.


RN-1165 (CM-22802)
The NCLU `bridge pvid` command does not add the interface to bridge ports

When you run the net add (bond|interface) <iface> bridge pvid command, NCLU does not add the port as a slave of the VLAN-aware bridge.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1171 (CM-22950)
Debian Security Advisory DSA-4335-1 for nginx issues CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

The following CVEs were announced in Debian Security Advisory DSA-4335-1, and affect the nginx package.

This issue is fixed in Cumulus RMP 3.7.3.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4335-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

November 08, 2018 https://www.debian.org/security/faq

------------------------------------------------------------------------------------------

Package : nginx

CVE ID : CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

Three vulnerabilities were discovered in Nginx, a high-performance web and reverse proxy server, which could in denial of service in processing HTTP/2 (via excessive memory/CPU usage) or server memory disclosure in the ngx_http_mp4_module module (used for server-side MP4 streaming).

For the stable distribution (stretch), these problems have been fixed in version 1.10.3-1+deb9u2.

We recommend that you upgrade your nginx packages.

For the detailed security status of nginx please refer to its security tracker page at:

https://security-tracker.debian.org/tracker/nginx


RN-1206 (CM-23399)
Debian Security Advisory DSA-4360-1 for libarchive CVE-2016-10209 CVE-2016-10349 CVE-2016-10350 CVE-2017-14166 CVE-2017-14501 CVE-2017-14502 CVE-2017-14503 CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000880

The following CVEs were announced in Debian Security Advisory DSA-4360-1, and affect the libarchive package.

This issue is fixed in Cumulus RMP 3.7.3.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4360-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

December 27, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------

Package: libarchive

CVE ID: CVE-2016-10209 CVE-2016-10349 CVE-2016-10350 CVE-2017-14166 CVE-2017-14501 CVE-2017-14502 CVE-2017-14503 CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000880

Multiple security issues were found in libarchive, a multi-format archive and compression library: Processing malformed RAR archives could result in denial of service or the execution of arbitrary code and malformed WARC, LHarc, ISO, Xar or CAB archives could result in denial of service.

For the stable distribution (stretch), these problems have been fixed inversion 3.2.2-2+deb9u1.

We recommend that you upgrade your libarchive packages.

For the detailed security status of libarchive, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/libarchive


RN-1208 (CM-23350)
PTMD shows the interface as `pass` when the link is down

If an interface is correctly configured according to the /etc/ptm.d/topology.dot file (pass), then the link goes down, ptmd still shows the cbl status as pass.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1210 (CM-23310)
KVM support for clock synchronization is missing in the Telemetry Server kernel

The kvm-clock module is missing in the kernel on the telemetry server. The system clock only advances one second for approximately every ten real-time seconds that pass. This stops NTP from being able to synchronize the clock.

This issue is fixed in Cumulus RMP 3.7.3.


RN-1213 (CM-23266)
Certain commands cause a traceback if the /etc/hostapd.conf file does not exist

When the /etc/hostapd.conf file does not exist, the following sequence of commands causes a traceback:

cumulus@switch:~$ net add interface swp1 link down
cumulus@switch:~$ net pending
cumulus@switch:~$ net commit
cumulus@switch:~$ net del interface swp1 link down

To work around this issue:

  1. Create the /etc/hostapd.conf file with the following default contents:
    eap_server=0 
    ieee8021x=1 
    driver=wired 
    interfaces= 
    mab_interfaces= 
    parking_vlan_interfaces= 
    parking_vlan_id= 
    mab_activation_delay=30 
    eap_reauth_period=0 
    eap_send_identity=0 
    ctrl_interface=/var/run/hostapd 
    nas_identifier=localhost 
    auth_server_addr= 
    auth_server_port=1812 
    auth_server_shared_secret= 
    acct_server_addr= 
    acct_server_port=1813 
    acct_server_shared_secret= 
    
  2. Issue the following commands to set the ownership and permissions:
    sudo chown root.root /etc/hostapd.conf 
    sudo chmod 600 /etc/hostapd.conf 
    

    This issue is fixed in Cumulus RMP 3.7.3.


RN-1215 (CM-23203)
ACL matching 0.0.0.0/32 installs as 0.0.0.0/0

Using an iptables rule (ACL) to block packets with a source IP address of exactly 0.0.0.0 unexpectedly drops all IPv4 packets.

This issue is fixed in Cumulus RMP 3.7.3.

Note: Cumulus Linux drops these packets by default and no rule is required.


RN-1217 (CM-23126)
Debian Security Advisory DSA-4349-1 for libtiff5 (tiff) CVE-2017-11613 CVE-2017-17095 CVE-2018-5784 CVE-2018-7456 CVE-2018-8905 CVE-2018-10963 CVE-2018-17101 CVE-2018-18557 CVE-2018-15209 CVE-2018-16335

The following CVEs were announced in Debian Security Advisory DSA-4349-1, and affect the libtiff5 package.

This issue is fixed in Cumulus RMP 3.7.3.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4349-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

November 30, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------

Package: libtiff5

CVE ID: CVE-2017-11613 CVE-2017-17095 CVE-2018-5784 CVE-2018-7456 CVE-2018-8905 CVE-2018-10963 CVE-2018-17101 CVE-2018-18557 CVE-2018-15209 CVE-2018-16335

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.

For the stable distribution (stretch), these problems have been fixed in version 4.0.8-2+deb9u4.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/tiff


RN-1218 (CM-22974)
Debian Security Advisory DSA-4338-1 for qemu CVE-2018-10839 CVE-2018-17962 CVE-2018-17963

The following CVEs were announced in Debian Security Advisory DSA-4338-1, and affect the qemu package.

This issue is fixed in Cumulus RMP 3.7.3.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4338-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

November 11, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------------------

Package: qemu

CVE ID: CVE-2018-10839 CVE-2018-17962 CVE-2018-17963

Debian Bug: 908682 910431 911468 911469

Integer overflows in the processing of packets in network cards emulated by QEMU, a fast processor emulator, could result in denial of service.

In addition this update backports support to passthrough the new CPU features added in the intel-microcode update shipped in DSA 4273 to x86-based guests.

For the stable distribution (stretch), these problems have been fixed in version 1:2.8+dfsg-6+deb9u5.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/qemu

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/


RN-1227 (CM-23135)
When you bring down an virtual interface, then run ifreload -a, the interface comes back up

Running ifdown vlan or ip link set vlan down brings down a virtual interface but the interface always comes back up after you run the ifreload -a or net commit command.

This issue is fixed in Cumulus RMP 3.7.3.

New Known Issues in Cumulus RMP 3.7.3

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1202 (CM-23398)
Debian Security Advisory DSA 4359-1 for wireshark CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628

The following CVEs were announced in Debian Security Advisory DSA-4359-1 and affect the wireshank package.

-----------------------------------------------------------------------------------

Debian Security Advisory DSA-4359-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

December 27, 2018 https://www.debian.org/security/faq

----------------------------------------------------------------------------------

Package: wireshark

CVE ID: CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628

Multiple vulnerabilities have been discovered in Wireshark, a network protocol analyzer, which could result in denial of service or the execution of arbitrary code.

For the stable distribution (stretch), these problems have been fixed in version 2.6.5-1~deb9u1.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/wireshark

This issue will be fixed in a future version of Cumulus Linux.


RN-1203 (CM-23535)
Debian Security Advisory DSA-4367-1 for systemd CVE-2018-16865

The following CVEs were announced in Debian Security Advisory DSA-4367-1 and affect the systemd package.

-----------------------------------------------------------------------------------

Debian Security Advisory DSA-4367-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

January 13, 2019 https://www.debian.org/security/faq

-----------------------------------------------------------------------------------

Package: systemd

CVE ID: CVE-2018-16864 CVE-2018-16865 CVE-2018-16866

Debian Bug: 918841 918848

The Qualys Research Labs discovered multiple vulnerabilities in systemd-journald. Two memory corruption flaws, via attacker-controlled alloca()s (CVE-2018-16864, CVE-2018-16865) and an out-of-bounds read flaw leading to an information leak (CVE-2018-16866), could allow an attacker to cause a denial of service or the execution of arbitrary code.

Further details in the Qualys Security Advisory at https://www.qualys.com/2019/01/09/system-down/system-down.txt

For the stable distribution (stretch), these problems have been fixed in version 232-25+deb9u7.

We recommend that you upgrade your systemd packages.

For the detailed security status of systemd, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/systemd

This issue will be fixed in a future version of Cumulus Linux.


RN-1219 (CM-23523)
NCLU `show_linux_command = True` does not show linux commands

Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect.

This is a known issue that is currently being investigated.


RN-1220 (CM-23422)
Error reading and writing from module causes module type to change

portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap.

This is a known issue that is currently being investigated.


RN-1221 (CM-23418)
`sudo ifdown` does not disable Tx Laser on QSFP+

For Flexoptix modules, the sudo ifdown command does not disable the Tx laser.

This is a known issue that is currently being investigated.


RN-1223 (CM-20966)
LLDP information is missing for a switch port when you run `net show interface`

The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected).

This is a known issue that is currently being investigated.


RN-1230 (CM-23584)
NCLU programs control plane ACL in FORWARD chain

When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain.

This is a known issue that is currently being investigated.


RN-1232 (CM-23372)
DHCP Relay does not work with traditional bridges

DHCP Relay does not work on traditional bridges. The DHCP Discover message is forwarded as unicast to the DHCP server and the Offer is received correctly, but is not forwarded to the client.

To work around this issue, make sure that the name of the bridge is no longer than 14 characters and change the name of the bridge if necessary.

This is a known issue that is currently being investigated.


RN-1236 (CM-23123)
FEC settings are persistent after being removed from the configuration

When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none.

This is a known issue that is currently being investigated.


RN-1251 (CM-23701)
cl-acltool fails to install multiple rules as ordered set

ACL install is sensitive to the ordering of the LOG/DROP rules. For example, an ACL policy.d file containing only the following:

[iptables]

-A FORWARD -s 192.0.2.10,192.0.2.11 -j LOG
-A FORWARD -s 192.0.2.10,192.0.2.11 -j DROP

fails to install with the following error message from cl-acltool -i:

error: hw sync failed (Cannot process iptables,FORWARD,78,Rule with LOG must be followed by same rule with DROP)

This happens because cl-acltool internally expands the two rules in the wrong order.

This is a known issue that is currently being investigated.


RN-1252 (CM-23700)
cl-acltool does not install LOG rules if the source or destination has multiple comma-separated prefixes

cl-acltool -i fails to install LOG rules if either the source or destination (-d or -s) has multiple comma-separated values, such as:

-A FORWARD -s "192.168.0.0/16" -d "192.168.0.0/16,172.16.0.0/12" -j LOG --log-prefix "DROP: "
-A FORWARD -s "192.168.0.0/16" -d "192.168.0.0/16,172.16.0.0/12" -j DROP

You see errors similar to the following:

error: hw sync failed (Cannot process iptables,FORWARD,46,Rule with LOG must be followed by same rule with DROP)
error: hw sync failed (Cannot process ip6tables,FORWARD,30,Rule with LOG must be followed by same rule with DROP)

This is a known issue that is currently being investigated.


RN-1253 (CM-23696)
IPv6 unregistered multicast packets flooded despite `bridge.optimized_mcast_flood = TRUE`

IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file.

This is a known issue that is currently being investigated.


RN-1256 (CM-23652)
`net show bridge spanning-tree` does not show the MLAG peer link in an STP forwarding instance

The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance:

This is a known issue that is currently being investigated.

Issues Fixed in Cumulus RMP 3.7.2

The following is a list of issues fixed in Cumulus RMP 3.7.2 from earlier versions of Cumulus RMP.

Release Note ID Summary Description

RN-1082 (CM-22257)
You can add ports as bridge ports multiple times with NCLU

When you add ports as bridge ports multiple times with the NCLU command, the commits succeed without error.

To work around this issue, remove the extra interfaces with the net del bridge bridge ports <interface> command.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1085 (CM-22237)
NCLU SNMP configuration does not start the SNMP server

When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning:

WARNING: snmpd is not running.  Run "journalctl -u snmpd" for error messages.

To work around this issue, start SNMP manually.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1092 (CM-22443)
IEEE 802.1X support for management VRF

Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1130 (CM-22618)
On Cumulus RMP, multiple failed ACL installations result in an `out of table resource` message even after reverting to a good rule set

After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1143 (CM-22631)
Adding MTU to a VLAN adds `mtu` lines for each bridge port even if they are not defined in /etc/network/interfaces

If you add the MTU to a VLAN with the NCLU net add vlan <vlan> mtu <mtu> command, Cumulus Linux adds extra mtu lines in the /etc/network/interfaces file when there are defined bridge ports that do not exist elsewhere in the file.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1156 (CM-22662)
Debian Security Advisory DSA-4314 for net-snmp issues CVE-2018-18065

The following CVEs were announced in Debian Security Advisory DSA-4314-1 and affect the net-snmp package.

This issue is fixed in Cumulus RMP 3.7.2.

------------------------------------------------------------------

Debian Security Advisory DSA-4314-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

October 11, 2018 https://www.debian.org/security/faq

------------------------------------------------------------------

Package : net-snmp

CVE ID : CVE-2018-18065

Debian Bug : 910638

Magnus Klaaborg Stubman discovered a NULL pointer dereference bug in net-snmp, a suite of Simple Network Management Protocol applications, allowing a remote, authenticated attacker to crash the snmpd process (causing a denial of service).

For the stable distribution (stretch), this problem has been fixed in version 5.7.3+dfsg-1.7+deb9u1.

We recommend that you upgrade your net-snmp packages.

For the detailed security status of net-snmp, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/net-snmp

Upstream info and fix are:

https://dumpco.re/blog/net-snmp-5.7.3-remote-dos

https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9bf8c457d/


RN-1173 (CM-22917)
The `poed` service is not enabled by default on PoE platforms in Cumulus Linux 3.7

When installing a Cumulus Linux 3.6.1 through 3.7.1 image, the poed service is not enabled by default.

This issue is fixed in Cumulus RMP 3.7.2.


RN-1180 (CM-22087)
NCLU fails to parse when `link-speed 10` is applied

NCLU does not allow for configuration of link-speed 10 and does not parse any unrelated NCLU configuration when link-speed 10 is detected in the /etc/network/interfaces file.

This issue is fixed in Cumulus RMP 3.7.2.

New Known Issues in Cumulus RMP 3.7.2

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1145 (CM-22560)
Debian Security Advisory DSA-4306-1 for python issues CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802

The following CVEs were announced in Debian Security Advisory DSA-4306-1 and affect the python package.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4306-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 27, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: python3.4

CVE ID: CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802

Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and the shutil module was affected by a command injection vulnerability.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

This issue will be fixed in a future release.


RN-1150 (CM-22891)
Debian Security Advisory DSA-4332-1 for ruby issues CVE-2018-16395 CVE-2018-16396

The following CVEs were announced in Debian Security Advisory DSA-4332-1 and affect the ruby package.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4332-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

November 03, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : ruby2.3

CVE ID : CVE-2018-16395 CVE-2018-16396

Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2018-16395

Tyler Eckstein reported that the equality check of OpenSSL::X509::Name could return true for non-equal objects. If a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal.

CVE-2018-16396

Chris Seaton discovered that tainted flags are not propagated in Array#pack and String#unpack with some directives.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u4.

We recommend that you upgrade your ruby2.3 packages.

For the detailed security status of ruby2.3, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ruby2.3

The 2.1 tracker for jessie is: https://security-tracker.debian.org/tracker/ruby2.1

This issue will be fixed in a future release.


RN-1158 (CM-22609)
Debian Security Advisory DSA-4311-1 for git issues CVE-2018-17456

The following CVEs were announced in Debian Security Advisory DSA-4311-1 and affect the git package.

-------------------------------------------------------------------

Debian Security Advisory DSA-4311-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

October 05, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------

Package : git

CVE ID : CVE-2018-17456

joernchen of Phenoelit discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability via a specially crafted .gitmodules file in a project cloned with --recurse-submodules.

For the stable distribution (stretch), this problem has been fixed in version 1:2.11.0-3+deb9u4.

We recommend that you upgrade your git packages.

For the detailed security status of git, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/git

This issue will be fixed in a future release.


RN-1159 (CM-22441)
Debian Security Advisory DSA-4924 for ghostscript issues CVE-2018-16509 CVE-2018-16802 CVE-2018-11645

The following CVEs were announced in Debian Security Advisory DSA-4924-1 and affect the ghostscript package.

----------------------------------------------------------

Debian Security Advisory DSA-4294-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 16, 2018 https://www.debian.org/security/faq

----------------------------------------------------------

Package : ghostscript

CVE ID : CVE-2018-16509 CVE-2018-16802

Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

For the stable distribution (stretch), these problems have been fixed in version 9.20~dfsg-3.2+deb9u5.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ghostscript

This issue will be fixed in a future release.


RN-1160 (CM-22298)
Debian Security Advisory DSA-4286-1 for curl issues CVE-2018-14618

The following CVEs were announced in Debian Security Advisory DSA-4286-1 and affect the curl package.

-------------------------------------------------------------

Debian Security Advisory DSA-4286-1 security@debian.org

https://www.debian.org/security/ Alessandro Ghedini

September 05, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------

Package : curl

CVE ID : CVE-2018-14618

Zhaoyang Wu discovered that cURL, an URL transfer library, contains a buffer overflow in the NTLM authentication code triggered by passwords that exceed 2GB in length on 32bit systems. See https://curl.haxx.se/docs/CVE-2018-14618.html for more information.

For the stable distribution (stretch), this problem has been fixed in version 7.52.1-5+deb9u7.

We recommend that you upgrade your curl packages.

For the detailed security status of curl, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/curl

This issue will be fixed in a future release.


RN-1161 (CM-22937)
NCLU SNMPv3 user configuration does not get applied correctly

NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.

To work around this issue, stop snmpd, remove the cache file, then restart snmpd.

This is a known issue that is currently being investigated.


RN-1165 (CM-22802)
The NCLU `bridge pvid` command does not add the interface to bridge ports

When you run the net add (bond|interface) <iface> bridge pvid command, NCLU does not add the port as a slave of the VLAN-aware bridge.

This is a known issue that is currently being investigated.


RN-1171 (CM-22950)
Debian Security Advisory DSA-4335-1 for nginx issues CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

The following CVEs were announced in Debian Security Advisory DSA-4335-1 and affect the nginx package.

-------------------------------------------------------------------------------------

Debian Security Advisory DSA-4335-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff November 08, 2018

https://www.debian.org/security/faq

--------------------------------------------------------------------------------------

Package : nginx

CVE ID : CVE-2018-16843 CVE-2018-16844 CVE-2018-16845

Three vulnerabilities were discovered in Nginx, a high-performance web and reverse proxy server, which could in denial of service in processing HTTP/2 (via excessive memory/CPU usage) or server memory disclosure in the ngx_http_mp4_module module (used for server-side MP4 streaming).

For the stable distribution (stretch), these problems have been fixed in version 1.10.3-1+deb9u2.

We recommend that you upgrade your nginx packages.

For the detailed security status of nginx, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/nginx

This issue will be fixed in a future release.


RN-1172 (CM-22346)
Debian Security Advisory DSA-4288-1 for ghostscript issues CVE-2018-15908 CVE-2018-15910 CVE-2018-15911 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585

The following CVEs were announced in Debian Security Advisory DSA-4288-1 and affect the ghostscript package.

-----------------------------------------------------------------

Debian Security Advisory DSA-4288-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

September 07, 2018 https://www.debian.org/security/faq

------------------------------------------------------------------

Package : ghostscript

CVE ID : CVE-2018-15908 CVE-2018-15910 CVE-2018-15911 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585

Tavis Ormandy discovered multiple vulnerabilities in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

For the stable distribution (stretch), these problems have been fixed in version 9.20~dfsg-3.2+deb9u4.

We recommend that you upgrade your ghostscript packages.

For the detailed security status of ghostscript, refer to its security tracker page at:

https://security-tracker.debian.org/tracker/ghostscript

This issue will be fixed in a future release.


RN-1192 (CM-23075)
Limitation on the number of interfaces supported in the DHCP relay file

There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example,1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:

2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51
2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on   LPF/vlan.101/a0:00:00:00:00:51

Eventually the dhcrelay service stops.

This is a known issue that is currently being investigated.

New Known Issues in Cumulus RMP 3.7.1

The following issues are new to Cumulus RMP and affect the current release.

Release Note ID Summary Description

RN-1130 (CM-22618)
On Cumulus RMP, multiple failed ACL installations result in an `out of table resource` message even after reverting to a good rule set

After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules.

This is a known issue that is currently being investigated.


RN-1133 (CM-22590)
NCLU `net show configuration commands` does not show output for an IPv6 rsyslog host

NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts.

This is a known issue that is currently being investigated.


RN-1134 (CM-22589)
NCLU `net show configuration commands` displays a syslog command with invalid syntax

NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:

cumulus@switch:~$ net add syslog host ipv4 10.0.0.1 port udp 514
cumulus@switch:~$ net commit

then run net show configuration commands, the output of the command syntax is invalid.

This is a known issue that is currently being investigated.


RN-1136 (CM-22554)
The link state of a bond is not updated when several members are brought down remotely at once

If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces does not correctly transition to the down state; however, all links show down in hardware.

This is a known issue that is currently being investigated.

Issues Fixed in Cumulus RMP 3.7.0

The following is a list of issues fixed in Cumulus RMP 3.7.0 from earlier versions of Cumulus RMP.

Release Note ID Summary Description

RN-1040 (CM-22120)
Link down does not work on an Ethernet interface configured in the management VRF

The link-down yes configuration in the /etc/network/interfaces file does not work for the eth0 or eth1 interface configured in the management VRF. This issue is not observed if the Ethernet interface is in the default VRF.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1041 (CM-21890)
Debian Security Advisory DSA-4259 for Ruby issues CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000073

The following CVEs were announced in Debian Security Advisory DSA-4259-1 and affect the ruby2.3 package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4259-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

July 31, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package: ruby2.3

CVE ID: CVE-2017-17405 CVE-2017-17742 CVE-2017-17790 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure.

This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.

For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u3.

We recommend that you upgrade your ruby2.3 packages.

Note: CVE-2018-1000073 and CVE-2018-1000074 are awaiting re-analysis.

For the detailed security status of ruby2.3, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby2.3


RN-1043 (CM-22066)
NCLU commands hang without response

When you run an NCLU command from the command line, the command hangs without a response.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1049 (CM-22161)
The ptmd shell environment variables are not being set correctly

When the ptmd daemon detects an LLDP neighbor change event, the respective script is executed (if-topo-pass or if-topo-fail). Environment variables are set and are accessible to the script (as described in man ptmd). However, in LLDP events, some environment variables are not getting set correctly.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1050 (CM-22146)
Repeating an existing SNMP v3 user returns wrong exit code

If SNMP is configured, entering the NCLU command to create an SNMP v3 user that already exists returns an exit code of 1.

To work around this issue, delete the username with net del snmp-server username <username> command before adding it again.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1056 (CM-22147)
Debian Security Advisory DSA-4280-1 for openssh issues CVE-2018-15473

The following CVEs were announced in Debian Security Advisory DSA-4280-1 and affect the openssh package.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4280-1 security@debian.org

https://www.debian.org/security/ Sebastien Delafond

August 22, 2018 https://www.debian.org/security/faq

--------------------------------------------------------------------------

Package : openssh

CVE ID : CVE-2018-15473

Debian Bug : 906236

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.

For the stable distribution (stretch), this problem has been fixed in version 1:7.4p1-10+deb9u4.

We recommend that you upgrade your openssh packages.

For the detailed security status of openssh, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh


RN-1057 (CM-21619)
Security: ntp issues CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185

The following CVEs affect ntp.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Ubuntu Security Notice USN-3707-1

July 09, 2018

ntp vulnerabilities

-------------------------------------------------------------------------

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.04 LTS

Ubuntu 17.10

Ubuntu 16.04 LTS

Ubuntu 14.04 LTS

Summary: Several security issues were fixed in NTP.

Software Description: ntp: Network Time Protocol daemon and utility programs

Details:

Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7184)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2018-7185)

Update instructions: The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS: ntp 1:4.2.8p10+dfsg-5ubuntu7.1

Ubuntu 17.10: ntp 1:4.2.8p10+dfsg-5ubuntu3.3

Ubuntu 16.04 LTS: ntp 1:4.2.8p4+dfsg-3ubuntu5.9

Ubuntu 14.04 LTS: ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13

In general, a standard system update will make all the necessary changes.

References: https://usn.ubuntu.com/usn/usn-3707-1

CVE-2018-7182, CVE-2018-7183, CVE-2018-7184, CVE-2018-7185


RN-1059 (CM-21939)
Debian Security Advisory DSA-4266-1 for kernel issues CVE-2018-13405

The following CVEs were announced in Debian Security Advisory DSA-4266-1 and affect the kernel.

This issue is fixed in Cumulus RMP 3.7.0.

-------------------------------------------------------------------------

Debian shows the CVE-2018-13405 details, including link to the kernel.org fix here: https://security-tracker.debian.org/tracker/CVE-2018-13405.

The kernel.org fix is here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7

Debian has the CVE-2018-5390 TCP DoS info here: https://security-tracker.debian.org/tracker/CVE-2018-5390.

CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') - CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. An attacker can induce a denial of service condition by sending specially modified packets within ongoing TCP sessions. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port. Thus, the attacks cannot be performed using spoofed IP addresses.

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e


RN-1060 (CM-22016)
Debian Security Advisor DSA-4269-1 for postgresql issues CVE-2018-10915 CVE-2018-10925

The following CVEs were announced in Debian Security Advisory DSA-4269-1 and affect the postgresql package.

CVE-2018-10925 is fixed in Cumulus RMP 3.7.0. CVE-2018-10915 will be fixed when it's fixed upstream.

-------------------------------------------------------------------------

Debian Security Advisory DSA-4269-1 security@debian.org

https://www.debian.org/security/ Moritz Muehlenhoff

August 10, 2018 https://www.debian.org/security/faq

-------------------------------------------------------------------------

Package : postgresql-9.6

CVE ID : CVE-2018-10915 CVE-2018-10925

Two vulnerabilities have been found in the PostgreSQL database system:

CVE-2018-10915

Andrew Krasichkov discovered that libpq did not reset all its connection state during reconnects.

CVE-2018-10925

It was discovered that some "CREATE TABLE" statements could disclose server memory.

For additional information, refer to the upstream announcement at https://www.postgresql.org/about/news/1878/

For the detailed security status of postgresql-9.6, refer to its security tracker page at: https://security-tracker.debian.org/tracker/postgresql-9.6

https://security-tracker.debian.org/tracker/source-package/postgresql-9.4

https://security-tracker.debian.org/tracker/CVE-2018-10915

https://security-tracker.debian.org/tracker/CVE-2018-10925

CVE-2018-10925 is listed as fixed in jessie source package: 9.4.19-0+deb8u1


RN-1061 (CM-22203)
The HTTP API enabled and listening by default

By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests.

This issue is fixed in Cumulus RMP 3.7.0.


RN-1111 (CM-21804)
`mstpd` prints unnecessary `bridge_notify: port ##: no_flush 0` log when there is a netlink link event

Whenever there is a netlink link event, mstpd prints an additional log: bridge_notify: port 65: no_flush 0 where 65 is the ifIndex. There are already clear logs when there is a link transition; this log is not necessary.

This issue is fixed in Cumulus RMP 3.7.0.

Known Issues in Cumulus RMP 3.7.0

The following known issues affect the current release.

Release Note ID Summary Description

RN-602 (CM-15094)
sFlow interface speed incorrect in counter samples

Counter samples exported from the switch show an incorrect interface speed.

This is a known issue that is currently being investigated.


RN-754 (CM-15812)
Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs

Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs.

This is a known issue that is currently being investigated.


RN-755 (CM-16855)
Auto-negotiation ON sometimes results in NO-CARRIER

If a two nodes on both sides of a link change from auto-negotiation off to auto-negotiation on for both sides during a short interval (around one second), the link might start flapping or stay down.

To work around this issue and stop the flapping, turn the link down on the switch with the command ifdown swpX, wait a few seconds, then bring the link back up with the command ifup swpX. Repeat this on the other side if necessary.


RN-758 (CM-17557)
If sFlow is enabled, some sampled packets (such as multicast) are forwarded twice

When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack).

This is a known issue that is currently being investigated.


RN-760 (CM-18682)
smonctl utility JSON parsing error

There is a parsing error with the smonctl utility. In some cases when JSON output is chosen, the smonctl utility crashes. The JSON output is necessary to make the information available through SNMP.

This is a known issue that is currently being investigated.


RN-788 (CM-19381)
dhcrelay does not bind to interfaces that have names longer than 14 characters

The dhcrelay command does not bind to an interface if the interface's name is longer than 14 characters.

To work around this issue, change the interface name to be 14 or fewer characters if dhcrelay is required to bind to it.

This is a known issue that is currently being investigated.


RN-822 (CM-19788)
Using the same VLAN ID on a subinterface and bridge VIDs for a given port is not easily corrected

If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface.

This is a known issue that is currently being investigated.


RN-823 (CM-19724)
Multicast control protocols are classified to the bulk queue by default

PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7.

This is a known issue that is currently being investigated.


RN-948 (CM-17494)
The default arp_ignore mode does not prevent reachable neighbor entries for hosts not on the connected subnet

In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.

To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information.


RN-1039 (CM-22045)
SNMPv3 Trap passwords and encryption keys longer then 16 characters might cause snmpd to core dump

SNMPv3 TRAP passwords or encryption keys longer then 16 characters might result in a core dump. For example:

net add snmp-server trap-destination 3.3.3.3 username 
verlongtrapusername auth-md5 verylongmd52345678901234567890 
encrypt-aes verylongencrypt567890123456789012345678 
engine-id 0x80001f8880f49b75319690895b00000000

# this results in a core dump:
root@cel-redxp-01:/home/cumulus# systemctl status  snmpd
   snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
   Loaded: loaded (/lib/systemd/system/snmpd.service; enabled)
   Active: failed (Result: core-dump) since Wed 2018-09-05 16:18:05 UTC; 1min 25s ago
  Process: 21163 ExecStart=/usr/sbin/snmpd $SNMPDOPTS -f (code=dumped, signal=SEGV)
 Main PID: 21163 (code=dumped, signal=SEGV)
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..

Sep 05 16:18:05 cel-redxp-01 systemd[1]: snmpd.service: main process exited, code=dumped, status=11/SEGV
Sep 05 16:18:05 cel-redxp-01 systemd[1]: Unit snmpd.service entered failed state.

To work around this issue, use SNMPv3 TRAP passwords and encryption keys that are 16 characters or shorter.

This is a known issue that is currently being investigated.


RN-1071 (CM-22345)
Redirected traffic increments the INPUT ACL rule counter but does not perform an action

If a packet to an unknown IP address (but known network) enters the switch and matches an INPUT ACL rule, it is redirected  for ARP and the counters increment for that rule, but it does not perform the action. This only happens until the ARP reply is sent, and then the traffic is forwarded properly.

To work around this issue, change the rules to INPUT,FORWARD instead of INPUT. Drops should then be logged properly.

This is a known issue that is currently being investigated.


RN-1074 (CM-22145)
The `net show configuration files` command does not include /etc/restapi.conf

The /etc/restapi.conf file is not listed in the net show configuration files command output.

This is a known issue that is currently being investigated.


RN-1082 (CM-22257)
You can add ports as bridge ports multiple times with NCLU

When you add ports as bridge ports multiple times with the NCLU cmmand, the commits succeed without error.

To work around this issue, remove the extra interfaces with the net del bridge bridge ports <interface> command.

This is a known issue that is currently being investigated.


RN-1085 (CM-22237)
NCLU SNMP configuration does not start the SNMP server

When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning:

WARNING: snmpd is not running.  Run "journalctl -u snmpd" for error messages.

To work around this issue, start SNMP manually.

This is a known issue that is currently being investigated.


RN-1092 (CM-22443)
IEEE 802.1X support for management VRF

Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed.

This issue is currently being investigated.


RN-1095 (CM-21813)
The NCLU `net add` and `net commit` commands edit the interfaces file even when the interface configuration is not changed

The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes.

This issue is currently being investigated.

Have more questions? Submit a request

Comments

Powered by Zendesk