Cumulus Linux 3.7 Release Notes
Download all 3.7 release notes as .xls
3.7.14.2 Release Notes
Open issues in 3.7.14.2
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-31420 | On a Cumulus Linux switch with high load averages, cl-support might end without creating a tar file and leave a temporary directory in /var/support undeleted. Subsequent runs of cl-support do not clean up this directory. | 3.7.13-3.7.14.2 | |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617005 | CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25687: several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server that could result in denial of service, cache poisoning or the execution of arbitrary code Vulnerable: <= 2.72-3+deb8u5Fixed: 2.72-3+deb8u6 | 3.7.14-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2607965 | On the EdgeCore AS7726 switch, when you run the NCLU net show system command, you see the error Command not found. | 3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2574294 | CVE-2021-3410: A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context Vulnerable: <= 0.99.beta19-2+deb8u1Fixed: 0.99.beta19-2+deb8u2 | 3.7.14-3.7.14.2 | |
| 2566880 | CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2562396 | CVE-2020-27824: Global buffer overflow on irreversible conversion when too many decomposition levels are specified. CVE-2020-27841: Crafted input to be processed by the openjpeg encoder could cause an out-of-bounds read. CVE-2020-27845: Crafted input can cause out-of-bounds-read. Vulnerable: <= 2.1.0-2+deb8u11 Fixed: 2.1.0-2+deb8u12 | 3.7.14-3.7.14.2 | |
| 2562347 | When you bring VXLAN interfaces up and down physically or administratively, the MTU for the SVIs changes to 1550 (the default value). | 3.7.14.2 | |
| 2562301 | CVE-2021-26937: encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Vulnerable: <= 4.2.1-3+deb8u1 Fixed: 4.2.1-3+deb8u2 | 3.7.14-3.7.14.2 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556816 CM-33419 | When ARP suppression is enabled, RARP packets sometimes get dropped and are not flooded by the local VTEP. To work around this issue, disable ARP suppression. | 3.7.14-3.7.14.2, 4.3.0 | |
| 2556783 CM-33398 | CVE-2021-0326: An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution. Vulnerable: <= 2.8.0-cl3.7.14u1, <= 2.8.0-cl4.2.1u1 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556780 CM-33397 | CVE-2021-27212: A vulnerability in the Certificate List Exact Assertion validation was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of this flaw to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u9 Fixed: 2.4.40+dfsg-1+deb8u10 | 3.7.14-3.7.14.2 | |
| 2556779 CM-33396 | CVE-2020-8625: Buffer overflow attack in the bind9 DNS server caused by an issue in the GSSAPI (“Generic Security Services”) security policy negotiation. Vulnerable: <= 9.9.5.dfsg-9+deb8u20 Fixed: 9.9.5.dfsg-9+deb8u21 | 3.7.14-3.7.14.2 | |
| 2556764 CM-33385 | In a configuration with both traditional and vlan-aware bridges, the VLAN membership check on a vlan-aware switch does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556743 CM-33370 | CVE-2019-20367: An issue has been found in libbsd, a library with utility functions from BSD systems. A non-NUL terminated symbol name in the string table might result in an out-of-bounds read. Vulnerable: <= 0.7.0-2+deb8u1 Fixed: 0.7.0-2+deb8u2 | 3.7.14-3.7.14.2 | |
| 2556742 CM-33369 | The following vulnerabilities have been announced in the openssl package: CVE-2021-23840: an issue where “Digital EnVeloPe” EVP-related calls could cause applications to behave incorrectly or even crash. CVE-2021-23841: an issue in the X509 certificate parsing caused by the lack of error handling while ingesting the “issuer” field. Vulnerable: <= 1.0.1t-1+deb8u13 Fixed: 1.0.1t-1+deb8u14 | 3.7.14-3.7.14.2 | |
| 2556689 CM-33333 | CVE-2020-15469 A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. CVE-2020-15859 QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data’s address set to the e1000e’s MMIO address. CVE-2020-25084 QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. CVE-2020-28916 hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address. CVE-2020-29130 slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. CVE-2020-29443 ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated. CVE-2021-20181 9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability. CVE-2021-20221 aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field. Vulnerable: <= 2.1+dfsg-12+deb8u18 Fixed: 2.1+dfsg-12+deb8u19 | 3.7.14-3.7.14.2 | |
| 2556612 CM-33311 | CVE-2021-27135: xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Vulnerable: 312-2 Fixed: 312-2+deb8u1. | 3.7.14-3.7.14.2 | |
| 2556585 CM-33295 | CVE-2021-26926: A heap buffer overflow vulnerability was discovered in JasPer, through jp2_dec.c in the jp2_decode() function. CVE-2021-26927: A null pointer access was discovered in JasPer, through jp2_dec.c in the jp2_decode() function. Vulnerable: <= 1.900.1-debian1-2.4+deb8u8 Fixed: 1.900.1-debian1-2.4+deb8u9 | 3.7.14-3.7.14.2 | |
| 2556530 CM-33272 | CVE-2020-0256: In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. CVE-2021-0308: In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. Vulnerable: 0.8.10-2 Fixed: 0.8.10-2+deb8u1 | 3.7.14-3.7.14.2 | |
| 2556525 CM-33270 | CVE-2020-27351: Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service. Vulnerable: <= 0.9.3.13 Fixed: 0.9.3.14 | 3.7.14-3.7.14.2 | |
| 2556504 CM-33260 | CVE-2020-36221 CVE-2020-36222 CVE-2020-36223 CVE-2020-36224 CVE-2020-36225 CVE-2020-36226 CVE-2020-36227 CVE-2020-36228 CVE-2020-36229 CVE-2020-36230: Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u8 Fixed: 2.4.40+dfsg-1+deb8u9 | 3.7.14-3.7.14.2 | |
| 2556473 CM-33246 | CVE-2021-3272: jp2_decode in jp2/jp2_dec.c in libjasper in JasPer has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. Vulnerable: <= 1.900.1-debian1-2.4+deb8u6 Fixed: 1.900.1-debian1-2.4+deb8u7 | 3.7.14-3.7.14.2 | |
| 2556364 CM-33191 | CVE-2020-35512: An issue has been found in dbus, a simple interprocess messaging system. On a system having multiple usernames sharing the same UID a use-after-free might happen, that could result in a denial of service or undefined behaviour, possibly including incorrect authorization decisions. Vulnerable: <= 1.8.22-0+deb8u3 Fixed: 1.8.22-0+deb8u4 | 3.7.14-3.7.14.2 | |
| 2556218 CM-33117 | The following vulnerability affects lldpd: CVE-2020-27827: A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Fixed: 1.0.4-0-cl4.3.0u2 | 3.7.14-4.2.1 | 4.3.0 |
| 2556061 CM-33032 | On Edgecore AS4610 switches, the historic CPU usage displayed in /run/sysmonitor/history is sometimes shown as a negative value. | 3.7.12-3.7.14.2, 4.2.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2556031 CM-33008 | Several security vulnerabilities were found in ImageMagick, a suite of image manipulation programs. An attacker could cause denial of service and execution of arbitrary code when a crafted image file is processed. CVE-2020-19667 Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c CVE-2020-25665 The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. This could cause impact to reliability. CVE-2020-25674 WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. CVE-2020-27560 ImageMagick allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. CVE-2020-27750 A flaw was found in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processedcould trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27760 In GammaImage() of /MagickCore/enhance.c, depending on the gamma value, it’s possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. CVE-2020-27763 A flaw was found in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27765 A flaw was found in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27773 A flaw was found in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-29599 ImageMagick mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c. Vulnerable: <= 6.8.9.9-5+deb8u21 Fixed: 6.8.9.9-5+deb8u22 | 3.7.14-3.7.14.2 | |
| 2556030 CM-33007 | The following vulnerability was announced in the apt packages: CVE-2020-27350: Missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. Vulnerable: <= 1.0.9.8.6 Fixed: 1.0.9.8.7 | 3.7.14-3.7.14.2 | |
| 2555691 CM-32829 | The NET-SNMP-EXTEND-MIB, disabled in Cumulus Linux 4.2.1 and 3.7.14 to prevent security vulnerability CVE-2020-15862, is re-enabled read-only. | 3.7.14-4.2.1 | 4.3.0 |
| 2555654 CM-32810 | The following vulnerability has been announced in the libflac8 package: CVE-2020-0499: In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. However, user interaction is needed for exploitation. Vulnerable: 1.3.0-3 Fixed: 1.3.0-3+deb8u1 | 3.7.14-3.7.14.2 | |
| 2555553 CM-32757 | It was discovered that the clean_html() function of lxml, a Python library for HTML and XML processing, performed insufficient sanitisation for embedded Javascript code. This might lead to cross-site scripting or possibly the execution of arbitrary code. Vulnerable: <= 3.4.0-1+deb8u2 Fixed: 3.4.0-1+deb8u3 | 3.7.14-3.7.14.2 | |
| 2555528 CM-32750 | In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. | 3.7.14-4.2.1 | 4.3.0 |
| 2555435 CM-32689 | CVE-2018-19139: Fix memory leaks by registering jpc_unk_destroyparms. CVE-2020-27828: Avoid maxrlvls more than upper bound to cause heap-buffer-overflow. CVE-2018-19543 and CVE-2017-9782: There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. Vulnerable: <= 1.900.1-debian1-2.4+deb8u6 Fixed: 1.900.1-debian1-2.4+deb8u7 | 3.7.14-3.7.14.2 | |
| 2555428 CM-32683 | When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. | 3.7.13-4.2.1 | 4.3.0 |
| 2555401 CM-32661 | On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0 |
| 2555196 CM-32537 | CVE-2018-19787, CVE-2020-27783: The clean_html() function of lxml, a Python library for HTML and XML processing, performed insufficient sanitisation for embedded Javascript code. This could lead to cross-site scripting or possibly the execution of arbitrary code. Vulnerable: <= 3.4.0-1+deb8u1 Fixed: 3.4.0-1+deb8u2 | 3.7.14-3.7.14.2 | |
| 2555148 CM-32516 | When using NCLU to add new BGP neighbors to existing configurations, the existence of address-family statements are ignored and the neighbors are added at the end of these lines. This might cause a problem if you try to activate these new neighbors in any of the existing address-family configurations. To work around this issue, configure the new BGP neighbors with vtysh. | 3.7.14-3.7.14.2, 4.2.1-4.3.0 | |
| 2555147 CM-32515 | Some issues have been found in qemu, a fast processor emulator. CVE-2020-25085 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-27617: All issues are related to assertion failures, out-of-bounds access failures or bad handling of return codes. Vulnerable: <= 2.1+dfsg-12+deb8u17 Fixed: 2.1+dfsg-12+deb8u18 | 3.7.14-3.7.14.2 | |
| 2554992 CM-32420 | When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. | 3.7.13-4.2.1 | 4.3.0 |
| 2554804 CM-32291 | On Mellanox SN2010 and SN2100 switches, the maximum fan speed is exceeded by fifteen percent. | 3.7.14-3.7.14.2 | |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554719 CM-32225 | A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. | 3.7.12-3.7.14.2 | |
| 2554709 CM-32217 | The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. | 3.7.13-3.7.14.2, 4.2.1-4.3.0 | |
| 2554617 CM-32169 | OpenSSH is vulnerable to CVE-2020-14145, as described in https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf. This is an information leak in algorithm negotiation that can allow man-in-the-middle attacks on initial connection attempts without a previously stored server host key on the client. If desired, mitigation using UpdateHostKeys and HostKeyAlgorithms is also given in that paper. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2554588 CM-32149 | If you try reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running.To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
to:
| 3.7.13-4.2.1 | 4.3.0 |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554329 CM-31978 | On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. | 3.7.12-3.7.14.2 | |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553677 CM-31605 | When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. | 3.7.13-3.7.14.2, 4.0.0-4.3.0 | |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2553050 CM-31322 | SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. | 3.7.12-3.7.14.2 | |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552870 CM-31232 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-3.7.14.2 | |
| 2552869 CM-31231 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-4.2.1 | 4.3.0 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552610 CM-31057 | The following vulnerability has been announced: CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c. | 3.7.13-4.2.0 | 4.2.1-4.3.0 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552266 CM-30863 | OpenSSH scp is vulnerable to CVE-2020-15778, where clients that have authorized access to the SSH server can execute commands on the server by copying maliciously named files. The two scenarios where an exploit may be useful to an attacker: -The user is authorized to scp but not ssh (based on the command option in the authorized_keys file), so this vulnerability can allow executing a remote command on the target computer when not authorized to do so.-An attacker plants a maliciously named file in a directory tree that someone later uses scp -r to copy over to the target computer.Be aware that restricting users to scp by using the command option in the authorized_keys file is not effective in preventing those users from executing arbitrary commands on the server.If you want to use scp -r to copy directory trees, avoid copying directory trees to which attackers may have added maliciously-named files. Archiving the directory tree with tar, zip, or a similar program, then copying the archive over to be extracted on the server avoids having to use scp -r altogether. In addition, OpenSSH provides sftp, which you can use instead of scp to copy files.To disable scp completely, use /bin/chmod 0 /usr/bin/scp . | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551565 CM-30414 | If you toggle VRRP priority values between VRRP routers, then run a switchd restart, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affected.To work around this issue, remove, then add the VRRP configuration with NCLU commands or vtysh in FRR. | 3.7.13-3.7.14.2, 4.2.0-4.3.0 | |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550466 CM-29890 | Multiple paths to identical EVPN prefixes are either not displayed or not accepted into the l2vpn evpn table if they are received from a different AS. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550196 CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.7.12-3.7.14.2 | |
| 2550056 CM-29652 | The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549872 CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549731 CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547120 CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2546992 CM-28004 | The wireshark packages (libwireshark5, libwireshark-data, wireshark, wireshark-common) available for optional installation on Cumulus Linux 3 are vulnerable to CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. More information at https://www.wireshark.org/security/wnpa-sec-2018-50.html and https://security-tracker.debian.org/tracker/CVE-2018-12086 . | 3.7.11-3.7.14.2 | |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546989 CM-28001 | The libxen packages are not installed on the switch by default, but are available in the repository for optional installation. Customers who optionally install the libxen packages should be aware of the following security advisory. Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. For more information, see https://security-tracker.debian.org/tracker/xen | 3.7.11-3.7.14.2 | |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546848 CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.7.11-3.7.14.2 | |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546203 CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. | 3.7.11-3.7.14.2 | |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545566 CM-27272 | The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537823 CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability." Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.7.11-3.7.14.2 | |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
Fixed Issues in 3.7.14.2
| Issue ID | Description | Affects |
|---|---|---|
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 |
| 2556288 CM-33165 | CVE-2021-3156: A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug. Vulnerable: <= 1.8.10p4-cl3.7.14u1 Fixed: 1.8.10p4-cl3.7.15u1 Note: security scanners may not recognize 1.8.10p4-cl3.7.15u1 as fixed and therefore incorrectly list it as vulnerable. | 3.7.14 |
| 2556012 CM-32994 | On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. | 3.7.14, 4.0.0-4.2.1 |
| 2555628 CM-32797 | The following vulnerabilities have been announced in curl: CVE-2020-8284: Vulnerability to malicious FTP server with PASV response with different IP address. CVE-2020-8285: Wildcard matching is vulnerable to denial of service by running out of stack space. Vulnerable: <= 7.38.0-4+deb8u18 Fixed: 7.38.0-4+deb8u19 | 3.7.14 |
| 2555508 CM-32734 | CVE-2018-0734: A minor timing side channel attack was found in the OpenSSL DSA signature algorithm. The fix for that introduced a more severe regression that could also be exploited as a timing side channel attack. This update fixes both the original problem and the subsequent issue. CVE-2020-1971: A flaw in the GENERAL_NAME_cmp() function could cause a NULL dereference, resulting in denial of service. Vulnerable: <= 1.0.1t-1+deb8u12 Fixed: 1.0.1t-1+deb8u13 | 3.7.14 |
| 2555494 CM-32728 | On Broadcom switches, when WARN level switchd log messages are generated, switchd might crash resulting in a core file generated on the system. | 3.7.14 |
| 2555315 CM-32609 | CVE-2020-25709, CVE-2020-25710: Vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u7 Fixed: 2.4.40+dfsg-1+deb8u8 | 3.7.14 |
| 2555178 CM-32529 | On Mellanox switches, the ASIC temperature sensor reading reports zeros. As a result, the fan speed is higher than normal. You can see the temperature reading in the output of the sensors command. | 3.7.14 |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 |
3.7.14 Release Notes
Open issues in 3.7.14
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-31420 | On a Cumulus Linux switch with high load averages, cl-support might end without creating a tar file and leave a temporary directory in /var/support undeleted. Subsequent runs of cl-support do not clean up this directory. | 3.7.13-3.7.14.2 | |
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 | 3.7.14.2, 4.3.0 |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617005 | CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25687: several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server that could result in denial of service, cache poisoning or the execution of arbitrary code Vulnerable: <= 2.72-3+deb8u5Fixed: 2.72-3+deb8u6 | 3.7.14-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2574294 | CVE-2021-3410: A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context Vulnerable: <= 0.99.beta19-2+deb8u1Fixed: 0.99.beta19-2+deb8u2 | 3.7.14-3.7.14.2 | |
| 2566880 | CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2562396 | CVE-2020-27824: Global buffer overflow on irreversible conversion when too many decomposition levels are specified. CVE-2020-27841: Crafted input to be processed by the openjpeg encoder could cause an out-of-bounds read. CVE-2020-27845: Crafted input can cause out-of-bounds-read. Vulnerable: <= 2.1.0-2+deb8u11 Fixed: 2.1.0-2+deb8u12 | 3.7.14-3.7.14.2 | |
| 2562301 | CVE-2021-26937: encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Vulnerable: <= 4.2.1-3+deb8u1 Fixed: 4.2.1-3+deb8u2 | 3.7.14-3.7.14.2 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556816 CM-33419 | When ARP suppression is enabled, RARP packets sometimes get dropped and are not flooded by the local VTEP. To work around this issue, disable ARP suppression. | 3.7.14-3.7.14.2, 4.3.0 | |
| 2556783 CM-33398 | CVE-2021-0326: An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution. Vulnerable: <= 2.8.0-cl3.7.14u1, <= 2.8.0-cl4.2.1u1 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556780 CM-33397 | CVE-2021-27212: A vulnerability in the Certificate List Exact Assertion validation was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of this flaw to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u9 Fixed: 2.4.40+dfsg-1+deb8u10 | 3.7.14-3.7.14.2 | |
| 2556779 CM-33396 | CVE-2020-8625: Buffer overflow attack in the bind9 DNS server caused by an issue in the GSSAPI (“Generic Security Services”) security policy negotiation. Vulnerable: <= 9.9.5.dfsg-9+deb8u20 Fixed: 9.9.5.dfsg-9+deb8u21 | 3.7.14-3.7.14.2 | |
| 2556764 CM-33385 | In a configuration with both traditional and vlan-aware bridges, the VLAN membership check on a vlan-aware switch does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556743 CM-33370 | CVE-2019-20367: An issue has been found in libbsd, a library with utility functions from BSD systems. A non-NUL terminated symbol name in the string table might result in an out-of-bounds read. Vulnerable: <= 0.7.0-2+deb8u1 Fixed: 0.7.0-2+deb8u2 | 3.7.14-3.7.14.2 | |
| 2556742 CM-33369 | The following vulnerabilities have been announced in the openssl package: CVE-2021-23840: an issue where “Digital EnVeloPe” EVP-related calls could cause applications to behave incorrectly or even crash. CVE-2021-23841: an issue in the X509 certificate parsing caused by the lack of error handling while ingesting the “issuer” field. Vulnerable: <= 1.0.1t-1+deb8u13 Fixed: 1.0.1t-1+deb8u14 | 3.7.14-3.7.14.2 | |
| 2556689 CM-33333 | CVE-2020-15469 A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. CVE-2020-15859 QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data’s address set to the e1000e’s MMIO address. CVE-2020-25084 QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. CVE-2020-28916 hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address. CVE-2020-29130 slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. CVE-2020-29443 ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated. CVE-2021-20181 9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability. CVE-2021-20221 aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field. Vulnerable: <= 2.1+dfsg-12+deb8u18 Fixed: 2.1+dfsg-12+deb8u19 | 3.7.14-3.7.14.2 | |
| 2556612 CM-33311 | CVE-2021-27135: xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Vulnerable: 312-2 Fixed: 312-2+deb8u1. | 3.7.14-3.7.14.2 | |
| 2556585 CM-33295 | CVE-2021-26926: A heap buffer overflow vulnerability was discovered in JasPer, through jp2_dec.c in the jp2_decode() function. CVE-2021-26927: A null pointer access was discovered in JasPer, through jp2_dec.c in the jp2_decode() function. Vulnerable: <= 1.900.1-debian1-2.4+deb8u8 Fixed: 1.900.1-debian1-2.4+deb8u9 | 3.7.14-3.7.14.2 | |
| 2556530 CM-33272 | CVE-2020-0256: In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. CVE-2021-0308: In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. Vulnerable: 0.8.10-2 Fixed: 0.8.10-2+deb8u1 | 3.7.14-3.7.14.2 | |
| 2556525 CM-33270 | CVE-2020-27351: Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service. Vulnerable: <= 0.9.3.13 Fixed: 0.9.3.14 | 3.7.14-3.7.14.2 | |
| 2556504 CM-33260 | CVE-2020-36221 CVE-2020-36222 CVE-2020-36223 CVE-2020-36224 CVE-2020-36225 CVE-2020-36226 CVE-2020-36227 CVE-2020-36228 CVE-2020-36229 CVE-2020-36230: Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u8 Fixed: 2.4.40+dfsg-1+deb8u9 | 3.7.14-3.7.14.2 | |
| 2556473 CM-33246 | CVE-2021-3272: jp2_decode in jp2/jp2_dec.c in libjasper in JasPer has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. Vulnerable: <= 1.900.1-debian1-2.4+deb8u6 Fixed: 1.900.1-debian1-2.4+deb8u7 | 3.7.14-3.7.14.2 | |
| 2556364 CM-33191 | CVE-2020-35512: An issue has been found in dbus, a simple interprocess messaging system. On a system having multiple usernames sharing the same UID a use-after-free might happen, that could result in a denial of service or undefined behaviour, possibly including incorrect authorization decisions. Vulnerable: <= 1.8.22-0+deb8u3 Fixed: 1.8.22-0+deb8u4 | 3.7.14-3.7.14.2 | |
| 2556288 CM-33165 | CVE-2021-3156: A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug. Vulnerable: <= 1.8.10p4-cl3.7.14u1 Fixed: 1.8.10p4-cl3.7.15u1 Note: security scanners may not recognize 1.8.10p4-cl3.7.15u1 as fixed and therefore incorrectly list it as vulnerable. | 3.7.14 | 3.7.14.2 |
| 2556218 CM-33117 | The following vulnerability affects lldpd: CVE-2020-27827: A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Fixed: 1.0.4-0-cl4.3.0u2 | 3.7.14-4.2.1 | 4.3.0 |
| 2556061 CM-33032 | On Edgecore AS4610 switches, the historic CPU usage displayed in /run/sysmonitor/history is sometimes shown as a negative value. | 3.7.12-3.7.14.2, 4.2.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2556031 CM-33008 | Several security vulnerabilities were found in ImageMagick, a suite of image manipulation programs. An attacker could cause denial of service and execution of arbitrary code when a crafted image file is processed. CVE-2020-19667 Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c CVE-2020-25665 The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. This could cause impact to reliability. CVE-2020-25674 WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. CVE-2020-27560 ImageMagick allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. CVE-2020-27750 A flaw was found in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processedcould trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27760 In GammaImage() of /MagickCore/enhance.c, depending on the gamma value, it’s possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. CVE-2020-27763 A flaw was found in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27765 A flaw was found in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-27773 A flaw was found in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2020-29599 ImageMagick mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c. Vulnerable: <= 6.8.9.9-5+deb8u21 Fixed: 6.8.9.9-5+deb8u22 | 3.7.14-3.7.14.2 | |
| 2556030 CM-33007 | The following vulnerability was announced in the apt packages: CVE-2020-27350: Missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. Vulnerable: <= 1.0.9.8.6 Fixed: 1.0.9.8.7 | 3.7.14-3.7.14.2 | |
| 2556012 CM-32994 | On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. | 3.7.14, 4.0.0-4.2.1 | 3.7.14.2, 4.3.0 |
| 2555691 CM-32829 | The NET-SNMP-EXTEND-MIB, disabled in Cumulus Linux 4.2.1 and 3.7.14 to prevent security vulnerability CVE-2020-15862, is re-enabled read-only. | 3.7.14-4.2.1 | 4.3.0 |
| 2555654 CM-32810 | The following vulnerability has been announced in the libflac8 package: CVE-2020-0499: In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. However, user interaction is needed for exploitation. Vulnerable: 1.3.0-3 Fixed: 1.3.0-3+deb8u1 | 3.7.14-3.7.14.2 | |
| 2555628 CM-32797 | The following vulnerabilities have been announced in curl: CVE-2020-8284: Vulnerability to malicious FTP server with PASV response with different IP address. CVE-2020-8285: Wildcard matching is vulnerable to denial of service by running out of stack space. Vulnerable: <= 7.38.0-4+deb8u18 Fixed: 7.38.0-4+deb8u19 | 3.7.14 | 3.7.14.2 |
| 2555553 CM-32757 | It was discovered that the clean_html() function of lxml, a Python library for HTML and XML processing, performed insufficient sanitisation for embedded Javascript code. This might lead to cross-site scripting or possibly the execution of arbitrary code. Vulnerable: <= 3.4.0-1+deb8u2 Fixed: 3.4.0-1+deb8u3 | 3.7.14-3.7.14.2 | |
| 2555528 CM-32750 | In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. | 3.7.14-4.2.1 | 4.3.0 |
| 2555508 CM-32734 | CVE-2018-0734: A minor timing side channel attack was found in the OpenSSL DSA signature algorithm. The fix for that introduced a more severe regression that could also be exploited as a timing side channel attack. This update fixes both the original problem and the subsequent issue. CVE-2020-1971: A flaw in the GENERAL_NAME_cmp() function could cause a NULL dereference, resulting in denial of service. Vulnerable: <= 1.0.1t-1+deb8u12 Fixed: 1.0.1t-1+deb8u13 | 3.7.14 | 3.7.14.2 |
| 2555494 CM-32728 | On Broadcom switches, when WARN level switchd log messages are generated, switchd might crash resulting in a core file generated on the system. | 3.7.14 | 3.7.14.2, 4.3.0 |
| 2555435 CM-32689 | CVE-2018-19139: Fix memory leaks by registering jpc_unk_destroyparms. CVE-2020-27828: Avoid maxrlvls more than upper bound to cause heap-buffer-overflow. CVE-2018-19543 and CVE-2017-9782: There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. Vulnerable: <= 1.900.1-debian1-2.4+deb8u6 Fixed: 1.900.1-debian1-2.4+deb8u7 | 3.7.14-3.7.14.2 | |
| 2555428 CM-32683 | When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. | 3.7.13-4.2.1 | 4.3.0 |
| 2555401 CM-32661 | On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0 |
| 2555315 CM-32609 | CVE-2020-25709, CVE-2020-25710: Vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.40+dfsg-1+deb8u7 Fixed: 2.4.40+dfsg-1+deb8u8 | 3.7.14 | 3.7.14.2 |
| 2555278 CM-32597 | When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.14 | 4.0.0-4.3.0 |
| 2555196 CM-32537 | CVE-2018-19787, CVE-2020-27783: The clean_html() function of lxml, a Python library for HTML and XML processing, performed insufficient sanitisation for embedded Javascript code. This could lead to cross-site scripting or possibly the execution of arbitrary code. Vulnerable: <= 3.4.0-1+deb8u1 Fixed: 3.4.0-1+deb8u2 | 3.7.14-3.7.14.2 | |
| 2555178 CM-32529 | On Mellanox switches, the ASIC temperature sensor reading reports zeros. As a result, the fan speed is higher than normal. You can see the temperature reading in the output of the sensors command. | 3.7.14 | 3.7.14.2 |
| 2555148 CM-32516 | When using NCLU to add new BGP neighbors to existing configurations, the existence of address-family statements are ignored and the neighbors are added at the end of these lines. This might cause a problem if you try to activate these new neighbors in any of the existing address-family configurations. To work around this issue, configure the new BGP neighbors with vtysh. | 3.7.14-3.7.14.2, 4.2.1-4.3.0 | |
| 2555147 CM-32515 | Some issues have been found in qemu, a fast processor emulator. CVE-2020-25085 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-27617: All issues are related to assertion failures, out-of-bounds access failures or bad handling of return codes. Vulnerable: <= 2.1+dfsg-12+deb8u17 Fixed: 2.1+dfsg-12+deb8u18 | 3.7.14-3.7.14.2 | |
| 2554992 CM-32420 | When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. | 3.7.13-4.2.1 | 4.3.0 |
| 2554804 CM-32291 | On Mellanox SN2010 and SN2100 switches, the maximum fan speed is exceeded by fifteen percent. | 3.7.14-3.7.14.2 | |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554719 CM-32225 | A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. | 3.7.12-3.7.14.2 | |
| 2554709 CM-32217 | The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. | 3.7.13-3.7.14.2, 4.2.1-4.3.0 | |
| 2554617 CM-32169 | OpenSSH is vulnerable to CVE-2020-14145, as described in https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf. This is an information leak in algorithm negotiation that can allow man-in-the-middle attacks on initial connection attempts without a previously stored server host key on the client. If desired, mitigation using UpdateHostKeys and HostKeyAlgorithms is also given in that paper. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2554588 CM-32149 | If you try reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running.To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
to:
| 3.7.13-4.2.1 | 4.3.0 |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554329 CM-31978 | On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. | 3.7.12-3.7.14.2 | |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553677 CM-31605 | When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. | 3.7.13-3.7.14.2, 4.0.0-4.3.0 | |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2553050 CM-31322 | SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. | 3.7.12-3.7.14.2 | |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552870 CM-31232 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-3.7.14.2 | |
| 2552869 CM-31231 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-4.2.1 | 4.3.0 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552610 CM-31057 | The following vulnerability has been announced: CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c. | 3.7.13-4.2.0 | 4.2.1-4.3.0 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552266 CM-30863 | OpenSSH scp is vulnerable to CVE-2020-15778, where clients that have authorized access to the SSH server can execute commands on the server by copying maliciously named files. The two scenarios where an exploit may be useful to an attacker: -The user is authorized to scp but not ssh (based on the command option in the authorized_keys file), so this vulnerability can allow executing a remote command on the target computer when not authorized to do so.-An attacker plants a maliciously named file in a directory tree that someone later uses scp -r to copy over to the target computer.Be aware that restricting users to scp by using the command option in the authorized_keys file is not effective in preventing those users from executing arbitrary commands on the server.If you want to use scp -r to copy directory trees, avoid copying directory trees to which attackers may have added maliciously-named files. Archiving the directory tree with tar, zip, or a similar program, then copying the archive over to be extracted on the server avoids having to use scp -r altogether. In addition, OpenSSH provides sftp, which you can use instead of scp to copy files.To disable scp completely, use /bin/chmod 0 /usr/bin/scp . | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 | 3.7.14.2 |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551565 CM-30414 | If you toggle VRRP priority values between VRRP routers, then run a switchd restart, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affected.To work around this issue, remove, then add the VRRP configuration with NCLU commands or vtysh in FRR. | 3.7.13-3.7.14.2, 4.2.0-4.3.0 | |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550466 CM-29890 | Multiple paths to identical EVPN prefixes are either not displayed or not accepted into the l2vpn evpn table if they are received from a different AS. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550196 CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.7.12-3.7.14.2 | |
| 2550056 CM-29652 | The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549872 CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549731 CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547381 CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
| 3.7.11-3.7.14 | 4.0.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547120 CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2546992 CM-28004 | The wireshark packages (libwireshark5, libwireshark-data, wireshark, wireshark-common) available for optional installation on Cumulus Linux 3 are vulnerable to CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. More information at https://www.wireshark.org/security/wnpa-sec-2018-50.html and https://security-tracker.debian.org/tracker/CVE-2018-12086 . | 3.7.11-3.7.14.2 | |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546989 CM-28001 | The libxen packages are not installed on the switch by default, but are available in the repository for optional installation. Customers who optionally install the libxen packages should be aware of the following security advisory. Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. For more information, see https://security-tracker.debian.org/tracker/xen | 3.7.11-3.7.14.2 | |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546848 CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.7.11-3.7.14.2 | |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546203 CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. | 3.7.11-3.7.14.2 | |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545566 CM-27272 | The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537823 CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability." Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.7.11-3.7.14.2 | |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
Fixed Issues in 3.7.14
| Issue ID | Description | Affects |
|---|---|---|
| 2554706 CM-32214 | CVE-2020-8037: The ppp de-capsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. The buffer should be big enough to hold the captured data, but it doesn’t need to be big enough to hold the entire on-the-network packet, if we haven’t captured all of it. Vulnerable: <= 4.9.3-1~deb8u1 Fixed: 4.9.3-1~deb8u2 | 3.7.13 |
| 2554687 CM-32205 | CVE-2020-28196: There is a denial of service vulnerability in the MIT Kerberos network authentication system, krb5. The lack of a limit in the “ASN.1” decoder could lead to infinite recursion and allow an attacker to overrun the stack and cause the process to crash. Vulnerable: <= 1.12.1+dfsg-19+deb8u5 Fixed: 1.12.1+dfsg-19+deb8u6 | 3.7.13 |
| 2554609 CM-32164 | CVE-2020-25692: A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet. The slapd package is not present in the image or repository, although the OpenLDAP libraries are present. Vulnerable: <= 2.4.40+dfsg-1+deb8u6 Fixed: 2.4.40+dfsg-1+deb8u7 | 3.7.13 |
| 2554454 CM-32057 | The following vulnerability has been announced in the freetype / libfreetype6 packages: CVE-2020-15999: heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. Vulnerable: <= 2.5.2-3+deb8u4 Fixed: 2.5.2-3+deb8u5 | 3.7.13 |
| 2554376 CM-32011 | The following vulnerabilities have been announced in poppler (libpoppler46 and libpoppler-qt4-4): CVE-2019-10018: Floating point exception in the function PostScriptFunction::exec at Function.cc CVE-2019-14494: There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. Vulnerable: <= 0.26.5-2+deb8u13 Fixed: 0.26.5-2+deb8u14 | 3.7.13 |
| 2554375 CM-32010 | CVE-2020-27153: There was a double-free vulnerability in BlueZ, a suite of Bluetooth tools, utilities and daemons. A remote attacker could potentially cause a denial of service or code execution during service discovery, due to a redundant disconnect management (MGMT) event. Vulnerable: <= 5.43-2+deb9u2~deb8u1 Fixed: 5.43-2+deb9u2~deb8u2 | 3.7.13 |
| 2554332 CM-31981 | In an EVPN active/active environment, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of the ARP messages might be dropped by the ARP policer of the MLAG peer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. | |
| 2554232 CM-31929 | VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. | 3.7.12-3.7.13 |
| 2554130 CM-31863 | CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Vulnerable: <= 0.12.5-1+deb8u7 Fixed: 0.12.5-1+deb8u8 | 3.7.13 |
| 2553877 CM-31696 | The following vulnerability has been announced in libproxy: CVE-2020-26154: A possible buffer overflow vulnerability in libproxy when a server serving a PAC file sends more than 102400 bytes without a Content-Length present. Vulnerable: <= 0.4.11-4+deb8u1 Fixed: 0.4.11-4+deb8u2 | 3.7.13 |
| 2553876 CM-31695 | The following vulnerability has been announced in the ruby2.1 packages: CVE-2020-25613: WEBrick (bundled along with ruby2.1) was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request. Vulnerable: <= 2.1.5-2+deb8u10 Fixed: 2.1.5-2+deb8u11. | 3.7.13 |
| 2553847 CM-31674 | The following vulnerabilities have been announced in the python3.4 packages: CVE-2019-20907: Avoid infinite loop with crafted tar file by improving header validation. CVE-2020-26116: Avoid injection of HTTP headers via the HTTP method without rejecting newline characters. Vulnerable: <= 3.4.2-1+deb8u8 Fixed: 3.4.2-1+deb8u9 | 3.7.13 |
| 2553846 CM-31673 | CVE-2016-7949, CVE-2016-7950: The libxrender library has issues in the way various X client libraries handle the responses they receive from servers. Insufficient validation of data from the X server could cause out of boundary memory writes in the libXrender library potentially allowing the user to escalate their privileges. Vulnerable: 0.9.8-1 | |
| 2553763 CM-31631 | Several vulnerabilities were discovered in the Perl5 Database Interface (DBI). An attacker could trigger a denial-of-service (DoS), information disclosure and possibly execute arbitrary code. CVE-2013-7490: Using many arguments to methods for Callbacks may lead to memory corruption. CVE-2014-10401: DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute. CVE-2019-20919: The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. CVE-2020-14392: An untrusted pointer dereference flaw was found in Perl-DBI. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service’s availability. CVE-2020-14393: A buffer overflow on via an overlong DBD class name in dbih_setup_handle function may lead to data be written past the intended limit. Vulnerable: 1.631-3 Fixed: 1.631-3+deb8u1 | 3.7.13 |
| 2553738 CM-31622 | The following vulnerability has been announced in curl: CVE-2020-8231: In rare circumstances, when using the multi API of curl in combination with CURLOPT_CONNECT_ONLY, the wrong connection might be used when transfering data later. Vulnerable: <= 7.38.0-4+deb8u17 Fixed: 7.38.0-4+deb8u18 | 3.7.13 |
| 2553732 CM-31618 | A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2553588 CM-31565 | Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. | 3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 |
| 2553450 CM-31504 | On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. | 3.7.12-3.7.13, 4.2.1 |
| 2553375 CM-31475 | The following vulnerabilities have been announced in QEMU packages: CVE-2019-20382: Memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. CVE-2020-13253: sd_wp_addr in hw/sd/sd.c uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. CVE-2020-13754: hw/pci/msix.c allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. CVE-2020-14364: An out-of-bounds read/write access flaw was found in the USB emulator. This issue occurs while processing USB packets from a guest when USBDevice ‘setup_len’ exceeds its ‘data_buf[4096]’ in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. CVE-2020-16092: An assertion failure can occur in the network packet processing. This issue affects the vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c. Vulnerable: <= 2.1+dfsg-12+deb8u16 Fixed: 2.1+dfsg-12+deb8u17 | 3.7.13 |
| 2553310 CM-31454 | The following vulnerability has been announced in libproxy:CVE-2020-25219: There was a denial of service attack in libproxy, a library to make applications HTTP proxy aware. A remote server could cause an infinite stack recursion. Vulnerable: <= 0.4.11-4 Fixed: 0.4.11-4+deb8u1 | 3.7.13 |
| 2553309 CM-31453 | The following vulnerability has been announced in python-pip: CVE-2019-20916: When an URL was given in an install command, as a Content-Disposition HTTP header was permitted to have ../ components in its filename, arbitrary local files (eg. /root/.ssh/authorized_keys) could be overidden. Vulnerable: <= 1.5.6-5 Fixed: 1.5.6-5+deb8u1 | 3.7.13 |
| 2553229 CM-31412 | On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-3.7.13, 4.2.1 |
| 2553190 CM-31390 | The following vulnerabilities have been announced in libxml2: CVE-2017-8872: Global buffer-overflow in the htmlParseTryOrFinish function. CVE-2019-20388: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. CVE-2020-24977: Out-of-bounds read restricted to xmllint –htmlout. CVE-2020-7595: Infinite loop in xmlStringLenDecodeEntities can cause a denial of service. Vulnerable: <= 2.9.1+dfsg1-5+deb8u8 Fixed: 2.9.1+dfsg1-5+deb8u9 | 3.7.13 |
| 2553150 CM-31377 | The following vulnerabilities have been announced in libjpeg-turbo: CVE-2020-13790: Heap-based buffer over-read via a PPM input file. CVE-2020-14152: Improper handling of max_memory_to_use setting can lead to excessive memory consumption. Vulnerable: <= 1.3.1-12+deb8u2 Fixed: 1.3.1-12+deb8u3 | 3.7.13 |
| 2553049 CM-31321 | The following vulnerability has been announced in the libx11 libraries: CVE-2020-14363: Integer overflow in the init_om function of libX11, the X11 client-side library, which could lead to a double free. Vulnerable: <= 1.6.2-3+deb8u3 Fixed: 1.6.2-3+deb8u4 | 3.7.13 |
| 2553001 CM-31294 | When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094):* clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. | 3.7.12-3.7.13 |
| 2552954 CM-31274 | The following vulnerability has been announced in the apache2 package:CVE-2020-11985: apache2 was vulnerable to IP address spoofing when proxying using mod_remoteip and mod_rewrite. For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Vulnerable: <= 2.4.10-10+deb8u16 Fixed: 2.4.10-10+deb8u17 | 3.7.13 |
| 2552953 CM-31273 | The following vulnerability has been announced in the bind9 packages: CVE-2020-8622: Crafted responses to TSIG-signed requests could lead to an assertion failure, causing named, a Domain Name Server, to exit. This could be done by malicious server operators or guessing attackers. Vulnerable: <= 9.9.5.dfsg-9+deb8u19 Fixed: 9.9.5.dfsg-9+deb8u20 | 3.7.13 |
| 2552952 CM-31272 | The following vulnerability has been announced in the nss / libnss3 packages: CVE-2020-12403: The ChaCha20 symmetric key cipher algorithm did not correctly enforce the tag length which may have led to an out-of-bounds read and a lack of confidentiality. Vulnerable: <= 3.26-1+debu8u12 Fixed: 3.26-1+debu8u13 | 3.7.13 |
| 2552925 CM-31257 | On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. | 3.7.12-3.7.13 |
| 2552881 CM-31238 | IPv6 TCP or UDP connections (sourcing from an ephemeral port in the range 34048 to 35071) are not forwarded if the switch has more than one layer 2 VNI defined. The traffic might be locally switched on the bridge and dropped. To work around this issue, disable ARP/ND suppression to remove the internal ACL rule that affects the ports. | 3.7.13, 4.2.1 |
| 2552860 CM-31226 | Mellanox switches with the Spectrum ASIC fail to read PSU Fan/Temp sensors and report them as Absent. The following messages are observed in syslog:
| 3.7.13 |
| 2552840 CM-31210 | CVE-2020-14350: In PostgreSQL 9.4, an uncontrolled search path could allow users to run arbitrary SQL functions with elevated priviledges when a superuser runs certain ‘CREATE EXTENSION’ statements. Vulnerable: <= 9.4.26-0+deb8u2 Fixed: 9.4.26-0+deb8u3 | 3.7.13 |
| 2552756 CM-31158 | An issue has been found in python2.7, an interactive high-level object-oriented language. CVE-2019-20907: Opening a crafted tar file could result in an infinite loop due to missing header validation. Vulnerable: <= 2.7.9-2-ds1+deb8u5 Fixed: 2.7.9-2-ds1+deb8u6 | 3.7.13 |
| 2552715 CM-31130 | The following vulnerabilities have been announced in the ghostscript package, which is available for optional installation. These vulnerabilities can allow an attacker to elevate privileges or cause a denial of service with crafted PS/EPS/PDF files:CVE-2020-16287 CVE-2020-16288 CVE-2020-16289 CVE-2020-16290 CVE-2020-16291 CVE-2020-16292 CVE-2020-16293 CVE-2020-16294 CVE-2020-16295 CVE-2020-16296 CVE-2020-16297 CVE-2020-16298 CVE-2020-16299 CVE-2020-16300 CVE-2020-16301 CVE-2020-16302 CVE-2020-16303 CVE-2020-16304 CVE-2020-16305 CVE-2020-16306 CVE-2020-16307 CVE-2020-16308 CVE-2020-16309 CVE-2020-16310 CVE-2020-17538 Vulnerable: <= 9.26a~dfsg-0+deb8u6 Fixed: 9.26a~dfsg-0+deb8u7 | 3.7.13 |
| 2552714 CM-31129 | The following vulnerability has been announced: CVE-2020-17507: A vulnerability was discovered in qt4-x11, the cross-platform C++ application framework, which is available in the repository for optional installation. A specially-crafted XBM image file could have caused a buffer overread. Vulnerable: <= 4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 Fixed: 4.8.6+git64-g5dc8b2b+dfsg-3+deb8u3 | 3.7.13 |
| 2552647 CM-31086 | When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. | 3.7.10-3.7.13, 4.2.0 |
| 2552608 CM-31055 | The following vulnerability has been announced: CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. Fixed: 5.8.0-cl4.2.1u1, 5.8.0-cl3.7.14u1 | 3.7.13, 4.0.0-4.2.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 |
| 2552442 CM-30978 | The following vulnerability has been announced in pillow: CVE-2020-10177: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. The python-pil packages are not installed by default, but are available for optional installation. Vulnerable: <= 2.6.1-2+deb8u4 Fixed: 2.6.1-2+deb8u5 | 3.7.13 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 |
| 2552318 CM-30895 | Various security vulnerabilities have been fixed in imagemagick, which is available in the repository for optional installation. The list of CVEs is:CVE-2017-12805 CVE-2017-17681 CVE-2017-18252 CVE-2018-7443 CVE-2018-8804 CVE-2018-8960 CVE-2018-9133 CVE-2018-10177 CVE-2018-18024 CVE-2018-20467 CVE-2019-10131 CVE-2019-11472 CVE-2019-12977 CVE-2019-12978 CVE-2019-12979 CVE-2019-13300 CVE-2019-13307 CVE-2019-13454 Vulnerable: <= 6.8.9.9-5+deb8u19 Fixed: 6.8.9.9-5+deb8u20 | 3.7.13 |
| 2552302 CM-30885 | On a Mellanox switch with the Spectrum ASIC, you see LPC I2C driver errors similar to the following during boot:
| 3.7.13 |
| 2552298 CM-30882 | The following vulnerability has been announced in net-snmp: CVE-2020-15862: A privilege escalation involving the NET-SNMP-EXTEND-MIB support (which is enabled by default at compile-time). The fixed versions disable NET-SNMP-EXTEND-MIB support. Vulnerable: <= 5.8.0-cl3u11, <= 5.8.0-cl4u4 Fixed: 5.8.0-cl3.7.14u3, 5.8.0-cl4.2.1u1 | 3.7.13, 4.0.0-4.2.0 |
| 2552250 CM-30858 | A vulnerability was found in curl, a command line tool for transferring data with URL syntax. curl is installed by default on Cumulus Linux.CVE-2020-8177: When using when using -J (–remote-header-name) and -i (–include) in the same command line, a malicious server could force curl to overwrite the contents of local files with incoming HTTP headers. Vulnerable: <= 7.38.0-4+deb8u16 Fixed: 7.38.0-4+deb8u17 | |
| 2552249 CM-30857 | An issue has been found in luajit, a just in time compiler for Lua. CVE-2020-15890: An out-of-bounds read could happen because __gc handler frame traversal is mishandled. Vulnerable: 2.0.3+dfsg-3 Fixed: 2.0.3+dfsg-3+deb8u1 | |
| 2552236 CM-30845 | The following vulnerabilities were reported against qemu, which is available in the repository for optional installation:CVE-2020-13659: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. Vulnerable: <= 2.1+dfsg-12+deb8u15 Fixed: 2.1+dfsg-12+deb8u16 | 3.7.12-3.7.13 |
| 2552206 CM-30827 | If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551748 CM-30514 | In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. | 3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2551732 CM-30504 | When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551729 CM-30503 | In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551715 CM-30498 | There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551693 CM-30486 | A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. | 3.7.12-3.7.13, 4.1.1-4.2.0 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 |
| 2551651 CM-30464 | The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2550873 CM-30141 | In an MLAG configuration with static VXLAN, static tunnels become unreachable. | 3.7.13, 4.1.1-4.2.0 |
| 2550606 CM-29982 | A VRRP role change over the EVPN network causes excessive BGP updates and connectivity issues to VIP for about one minute. | 4.1.1-4.2.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 |
| 2549794 CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
| 3.7.11-3.7.13, 4.1.1-4.2.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 |
| 2548152 CM-28682 | On the Mellanox Spectrum switch in an EVPN symmetric configuration with MLAG, simultaneously shutting down the layer 3 interfaces that serve as uplinks to the VXLAN fabric might result in traffic loss of up to 15 seconds. | 4.1.0-4.1.1 |
| 2547799 CM-28451 | An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. | 3.7.11-3.7.13, 4.0.0-4.0.1 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 |
| 2547397 CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p4-cl3u6 Fixed: 1.8.10p4-cl3.7.14u1 | 3.7.13 |
| 2547341 CM-28189 | When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
| 3.7.13, 4.0.0-4.1.1 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2545934 CM-27489 | Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. | 3.7.13, 4.0.0-4.1.1 |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 |
| 2545537 CM-27254 | On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | 4.0.0-4.1.1 |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2535707 CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 4.0.0-4.1.1 |
| 2534978 CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 4.0.0-4.2.1 |
| 2529322 CM-15601 | On a Mellanox switch in an MLAG configuration, routed packets that arrive on one switch to be forwarded to a destination MAC across the peer link are dropped due to MLAG loop prevention. This affects both routed unicast and multicast packets. To work around this issue, modify the routing design or policy such that routes do not have a next hop of an MLAG peer switch that traverses the MLAG peer link. |
3.7.13 Release Notes
Open issues in 3.7.13
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-31420 | On a Cumulus Linux switch with high load averages, cl-support might end without creating a tar file and leave a temporary directory in /var/support undeleted. Subsequent runs of cl-support do not clean up this directory. | 3.7.13-3.7.14.2 | |
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 | 3.7.14.2, 4.3.0 |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556061 CM-33032 | On Edgecore AS4610 switches, the historic CPU usage displayed in /run/sysmonitor/history is sometimes shown as a negative value. | 3.7.12-3.7.14.2, 4.2.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2555428 CM-32683 | When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. | 3.7.13-4.2.1 | 4.3.0 |
| 2555278 CM-32597 | When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.14 | 4.0.0-4.3.0 |
| 2554992 CM-32420 | When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. | 3.7.13-4.2.1 | 4.3.0 |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554719 CM-32225 | A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. | 3.7.12-3.7.14.2 | |
| 2554709 CM-32217 | The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. | 3.7.13-3.7.14.2, 4.2.1-4.3.0 | |
| 2554706 CM-32214 | CVE-2020-8037: The ppp de-capsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. The buffer should be big enough to hold the captured data, but it doesn’t need to be big enough to hold the entire on-the-network packet, if we haven’t captured all of it. Vulnerable: <= 4.9.3-1~deb8u1 Fixed: 4.9.3-1~deb8u2 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554687 CM-32205 | CVE-2020-28196: There is a denial of service vulnerability in the MIT Kerberos network authentication system, krb5. The lack of a limit in the “ASN.1” decoder could lead to infinite recursion and allow an attacker to overrun the stack and cause the process to crash. Vulnerable: <= 1.12.1+dfsg-19+deb8u5 Fixed: 1.12.1+dfsg-19+deb8u6 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554609 CM-32164 | CVE-2020-25692: A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet. The slapd package is not present in the image or repository, although the OpenLDAP libraries are present. Vulnerable: <= 2.4.40+dfsg-1+deb8u6 Fixed: 2.4.40+dfsg-1+deb8u7 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554588 CM-32149 | If you try reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running.To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
to:
| 3.7.13-4.2.1 | 4.3.0 |
| 2554454 CM-32057 | The following vulnerability has been announced in the freetype / libfreetype6 packages: CVE-2020-15999: heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. Vulnerable: <= 2.5.2-3+deb8u4 Fixed: 2.5.2-3+deb8u5 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554376 CM-32011 | The following vulnerabilities have been announced in poppler (libpoppler46 and libpoppler-qt4-4): CVE-2019-10018: Floating point exception in the function PostScriptFunction::exec at Function.cc CVE-2019-14494: There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. Vulnerable: <= 0.26.5-2+deb8u13 Fixed: 0.26.5-2+deb8u14 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554375 CM-32010 | CVE-2020-27153: There was a double-free vulnerability in BlueZ, a suite of Bluetooth tools, utilities and daemons. A remote attacker could potentially cause a denial of service or code execution during service discovery, due to a redundant disconnect management (MGMT) event. Vulnerable: <= 5.43-2+deb9u2~deb8u1 Fixed: 5.43-2+deb9u2~deb8u2 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554329 CM-31978 | On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. | 3.7.12-3.7.14.2 | |
| 2554232 CM-31929 | VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2554130 CM-31863 | CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Vulnerable: <= 0.12.5-1+deb8u7 Fixed: 0.12.5-1+deb8u8 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553877 CM-31696 | The following vulnerability has been announced in libproxy: CVE-2020-26154: A possible buffer overflow vulnerability in libproxy when a server serving a PAC file sends more than 102400 bytes without a Content-Length present. Vulnerable: <= 0.4.11-4+deb8u1 Fixed: 0.4.11-4+deb8u2 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553876 CM-31695 | The following vulnerability has been announced in the ruby2.1 packages: CVE-2020-25613: WEBrick (bundled along with ruby2.1) was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to “smuggle” a request. Vulnerable: <= 2.1.5-2+deb8u10 Fixed: 2.1.5-2+deb8u11. | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553847 CM-31674 | The following vulnerabilities have been announced in the python3.4 packages: CVE-2019-20907: Avoid infinite loop with crafted tar file by improving header validation. CVE-2020-26116: Avoid injection of HTTP headers via the HTTP method without rejecting newline characters. Vulnerable: <= 3.4.2-1+deb8u8 Fixed: 3.4.2-1+deb8u9 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553763 CM-31631 | Several vulnerabilities were discovered in the Perl5 Database Interface (DBI). An attacker could trigger a denial-of-service (DoS), information disclosure and possibly execute arbitrary code. CVE-2013-7490: Using many arguments to methods for Callbacks may lead to memory corruption. CVE-2014-10401: DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute. CVE-2019-20919: The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. CVE-2020-14392: An untrusted pointer dereference flaw was found in Perl-DBI. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service’s availability. CVE-2020-14393: A buffer overflow on via an overlong DBD class name in dbih_setup_handle function may lead to data be written past the intended limit. Vulnerable: 1.631-3 Fixed: 1.631-3+deb8u1 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553738 CM-31622 | The following vulnerability has been announced in curl: CVE-2020-8231: In rare circumstances, when using the multi API of curl in combination with CURLOPT_CONNECT_ONLY, the wrong connection might be used when transfering data later. Vulnerable: <= 7.38.0-4+deb8u17 Fixed: 7.38.0-4+deb8u18 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553732 CM-31618 | A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553677 CM-31605 | When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. | 3.7.13-3.7.14.2, 4.0.0-4.3.0 | |
| 2553588 CM-31565 | Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 | 3.7.14, 4.3.0 |
| 2553450 CM-31504 | On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. | 3.7.12-3.7.13, 4.2.1 | 3.7.14, 4.3.0 |
| 2553375 CM-31475 | The following vulnerabilities have been announced in QEMU packages: CVE-2019-20382: Memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. CVE-2020-13253: sd_wp_addr in hw/sd/sd.c uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. CVE-2020-13754: hw/pci/msix.c allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. CVE-2020-14364: An out-of-bounds read/write access flaw was found in the USB emulator. This issue occurs while processing USB packets from a guest when USBDevice ‘setup_len’ exceeds its ‘data_buf[4096]’ in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. CVE-2020-16092: An assertion failure can occur in the network packet processing. This issue affects the vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c. Vulnerable: <= 2.1+dfsg-12+deb8u16 Fixed: 2.1+dfsg-12+deb8u17 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553310 CM-31454 | The following vulnerability has been announced in libproxy:CVE-2020-25219: There was a denial of service attack in libproxy, a library to make applications HTTP proxy aware. A remote server could cause an infinite stack recursion. Vulnerable: <= 0.4.11-4 Fixed: 0.4.11-4+deb8u1 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553309 CM-31453 | The following vulnerability has been announced in python-pip: CVE-2019-20916: When an URL was given in an install command, as a Content-Disposition HTTP header was permitted to have ../ components in its filename, arbitrary local files (eg. /root/.ssh/authorized_keys) could be overidden. Vulnerable: <= 1.5.6-5 Fixed: 1.5.6-5+deb8u1 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553229 CM-31412 | On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-3.7.13, 4.2.1 | 3.7.14, 4.3.0 |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553190 CM-31390 | The following vulnerabilities have been announced in libxml2: CVE-2017-8872: Global buffer-overflow in the htmlParseTryOrFinish function. CVE-2019-20388: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. CVE-2020-24977: Out-of-bounds read restricted to xmllint –htmlout. CVE-2020-7595: Infinite loop in xmlStringLenDecodeEntities can cause a denial of service. Vulnerable: <= 2.9.1+dfsg1-5+deb8u8 Fixed: 2.9.1+dfsg1-5+deb8u9 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553150 CM-31377 | The following vulnerabilities have been announced in libjpeg-turbo: CVE-2020-13790: Heap-based buffer over-read via a PPM input file. CVE-2020-14152: Improper handling of max_memory_to_use setting can lead to excessive memory consumption. Vulnerable: <= 1.3.1-12+deb8u2 Fixed: 1.3.1-12+deb8u3 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2553050 CM-31322 | SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. | 3.7.12-3.7.14.2 | |
| 2553049 CM-31321 | The following vulnerability has been announced in the libx11 libraries: CVE-2020-14363: Integer overflow in the init_om function of libX11, the X11 client-side library, which could lead to a double free. Vulnerable: <= 1.6.2-3+deb8u3 Fixed: 1.6.2-3+deb8u4 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2553001 CM-31294 | When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094):* clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2, 4.2.0-4.3.0 |
| 2552954 CM-31274 | The following vulnerability has been announced in the apache2 package:CVE-2020-11985: apache2 was vulnerable to IP address spoofing when proxying using mod_remoteip and mod_rewrite. For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Vulnerable: <= 2.4.10-10+deb8u16 Fixed: 2.4.10-10+deb8u17 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552953 CM-31273 | The following vulnerability has been announced in the bind9 packages: CVE-2020-8622: Crafted responses to TSIG-signed requests could lead to an assertion failure, causing named, a Domain Name Server, to exit. This could be done by malicious server operators or guessing attackers. Vulnerable: <= 9.9.5.dfsg-9+deb8u19 Fixed: 9.9.5.dfsg-9+deb8u20 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552952 CM-31272 | The following vulnerability has been announced in the nss / libnss3 packages: CVE-2020-12403: The ChaCha20 symmetric key cipher algorithm did not correctly enforce the tag length which may have led to an out-of-bounds read and a lack of confidentiality. Vulnerable: <= 3.26-1+debu8u12 Fixed: 3.26-1+debu8u13 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552925 CM-31257 | On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2552881 CM-31238 | IPv6 TCP or UDP connections (sourcing from an ephemeral port in the range 34048 to 35071) are not forwarded if the switch has more than one layer 2 VNI defined. The traffic might be locally switched on the bridge and dropped. To work around this issue, disable ARP/ND suppression to remove the internal ACL rule that affects the ports. | 3.7.13, 4.2.1 | 3.7.14, 4.3.0 |
| 2552870 CM-31232 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-3.7.14.2 | |
| 2552869 CM-31231 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-4.2.1 | 4.3.0 |
| 2552860 CM-31226 | Mellanox switches with the Spectrum ASIC fail to read PSU Fan/Temp sensors and report them as Absent. The following messages are observed in syslog:
| 3.7.13 | 3.7.14-3.7.14.2 |
| 2552840 CM-31210 | CVE-2020-14350: In PostgreSQL 9.4, an uncontrolled search path could allow users to run arbitrary SQL functions with elevated priviledges when a superuser runs certain ‘CREATE EXTENSION’ statements. Vulnerable: <= 9.4.26-0+deb8u2 Fixed: 9.4.26-0+deb8u3 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552756 CM-31158 | An issue has been found in python2.7, an interactive high-level object-oriented language. CVE-2019-20907: Opening a crafted tar file could result in an infinite loop due to missing header validation. Vulnerable: <= 2.7.9-2-ds1+deb8u5 Fixed: 2.7.9-2-ds1+deb8u6 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552715 CM-31130 | The following vulnerabilities have been announced in the ghostscript package, which is available for optional installation. These vulnerabilities can allow an attacker to elevate privileges or cause a denial of service with crafted PS/EPS/PDF files:CVE-2020-16287 CVE-2020-16288 CVE-2020-16289 CVE-2020-16290 CVE-2020-16291 CVE-2020-16292 CVE-2020-16293 CVE-2020-16294 CVE-2020-16295 CVE-2020-16296 CVE-2020-16297 CVE-2020-16298 CVE-2020-16299 CVE-2020-16300 CVE-2020-16301 CVE-2020-16302 CVE-2020-16303 CVE-2020-16304 CVE-2020-16305 CVE-2020-16306 CVE-2020-16307 CVE-2020-16308 CVE-2020-16309 CVE-2020-16310 CVE-2020-17538 Vulnerable: <= 9.26a~dfsg-0+deb8u6 Fixed: 9.26a~dfsg-0+deb8u7 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552714 CM-31129 | The following vulnerability has been announced: CVE-2020-17507: A vulnerability was discovered in qt4-x11, the cross-platform C++ application framework, which is available in the repository for optional installation. A specially-crafted XBM image file could have caused a buffer overread. Vulnerable: <= 4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 Fixed: 4.8.6+git64-g5dc8b2b+dfsg-3+deb8u3 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552647 CM-31086 | When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. | 3.7.10-3.7.13, 4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552610 CM-31057 | The following vulnerability has been announced: CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c. | 3.7.13-4.2.0 | 4.2.1-4.3.0 |
| 2552608 CM-31055 | The following vulnerability has been announced: CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. Fixed: 5.8.0-cl4.2.1u1, 5.8.0-cl3.7.14u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552442 CM-30978 | The following vulnerability has been announced in pillow: CVE-2020-10177: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. The python-pil packages are not installed by default, but are available for optional installation. Vulnerable: <= 2.6.1-2+deb8u4 Fixed: 2.6.1-2+deb8u5 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552318 CM-30895 | Various security vulnerabilities have been fixed in imagemagick, which is available in the repository for optional installation. The list of CVEs is:CVE-2017-12805 CVE-2017-17681 CVE-2017-18252 CVE-2018-7443 CVE-2018-8804 CVE-2018-8960 CVE-2018-9133 CVE-2018-10177 CVE-2018-18024 CVE-2018-20467 CVE-2019-10131 CVE-2019-11472 CVE-2019-12977 CVE-2019-12978 CVE-2019-12979 CVE-2019-13300 CVE-2019-13307 CVE-2019-13454 Vulnerable: <= 6.8.9.9-5+deb8u19 Fixed: 6.8.9.9-5+deb8u20 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2552302 CM-30885 | On a Mellanox switch with the Spectrum ASIC, you see LPC I2C driver errors similar to the following during boot:
| 3.7.13 | 3.7.14-3.7.14.2 |
| 2552298 CM-30882 | The following vulnerability has been announced in net-snmp: CVE-2020-15862: A privilege escalation involving the NET-SNMP-EXTEND-MIB support (which is enabled by default at compile-time). The fixed versions disable NET-SNMP-EXTEND-MIB support. Vulnerable: <= 5.8.0-cl3u11, <= 5.8.0-cl4u4 Fixed: 5.8.0-cl3.7.14u3, 5.8.0-cl4.2.1u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552236 CM-30845 | The following vulnerabilities were reported against qemu, which is available in the repository for optional installation:CVE-2020-13659: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. Vulnerable: <= 2.1+dfsg-12+deb8u15 Fixed: 2.1+dfsg-12+deb8u16 | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 | 3.7.14.2 |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2552206 CM-30827 | If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551748 CM-30514 | In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2551732 CM-30504 | When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551729 CM-30503 | In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551715 CM-30498 | There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551693 CM-30486 | A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. | 3.7.12-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551651 CM-30464 | The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551565 CM-30414 | If you toggle VRRP priority values between VRRP routers, then run a switchd restart, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affected.To work around this issue, remove, then add the VRRP configuration with NCLU commands or vtysh in FRR. | 3.7.13-3.7.14.2, 4.2.0-4.3.0 | |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550873 CM-30141 | In an MLAG configuration with static VXLAN, static tunnels become unreachable. | 3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550466 CM-29890 | Multiple paths to identical EVPN prefixes are either not displayed or not accepted into the l2vpn evpn table if they are received from a different AS. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550196 CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.7.12-3.7.14.2 | |
| 2550056 CM-29652 | The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549872 CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549794 CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
| 3.7.11-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549731 CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547799 CM-28451 | An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. | 3.7.11-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547397 CM-28219 | The following vulnerability affects sudo, which is installed by default on Cumulus Linux. It is potentially exploitable on Cumulus Linux if pwfeedback (which is NOT enabled by default) is enabled in the /etc/sudoers file. CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. For more information, refer to: https://security-tracker.debian.org/tracker/source-package/sudo https://security-tracker.debian.org/tracker/CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html Vulnerable: <= 1.8.10p4-cl3u6 Fixed: 1.8.10p4-cl3.7.14u1 | 3.7.13 | 3.7.14-3.7.14.2 |
| 2547381 CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
| 3.7.11-3.7.14 | 4.0.0-4.3.0 |
| 2547341 CM-28189 | When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
| 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547120 CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2546992 CM-28004 | The wireshark packages (libwireshark5, libwireshark-data, wireshark, wireshark-common) available for optional installation on Cumulus Linux 3 are vulnerable to CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. More information at https://www.wireshark.org/security/wnpa-sec-2018-50.html and https://security-tracker.debian.org/tracker/CVE-2018-12086 . | 3.7.11-3.7.14.2 | |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546989 CM-28001 | The libxen packages are not installed on the switch by default, but are available in the repository for optional installation. Customers who optionally install the libxen packages should be aware of the following security advisory. Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. For more information, see https://security-tracker.debian.org/tracker/xen | 3.7.11-3.7.14.2 | |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546848 CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.7.11-3.7.14.2 | |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546203 CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. | 3.7.11-3.7.14.2 | |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545934 CM-27489 | Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. | 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 | 3.7.14-3.7.14.2, 4.1.0-4.3.0 |
| 2545566 CM-27272 | The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537823 CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability." Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.7.11-3.7.14.2 | |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
Fixed Issues in 3.7.13
| Issue ID | Description | Affects |
|---|---|---|
| 2552187 CM-30818 | The following vulnerabilities have been announced in librsvg, which is available in the repository for optional installation:CVE-2016-6163: The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file. CVE-2019-20446: In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially. Vulnerable: <= 2.40.5-1+deb8u2 Fixed: 2.40.5-1+deb8u3 | 3.7.12 |
| 2551916 CM-30582 | The following vulnerability has been announced in glib-networking, which is not installed by default, but is available in the repository for optional installation. CVE-2020-13645: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Vulnerable: 2.42.0-2 Fixed: 2.42.0-2+deb8u1 | 3.7.12 |
| 2551915 CM-30581 | The following vulnerabilities have been announced in NGINX, which is installed by default on Cumulus Linux (however, the default nginx configuration is not vulnerable, since it does not configure error_page redirection or use lua): CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. CVE-2020-11724: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. Vulnerable: <= 1.6.2-5+deb8u6 Fixed: 1.6.2-5+deb8u7 | 3.7.12 |
| 2551780 CM-30533 | CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice. Vulnerable: <= 2.1.0-2+deb8u10 Fixed: 2.1.0-2+deb8u11 | 3.7.12 |
| 2551779 CM-30532 | Several issues were discovered in Python 3.4, an interactive high-level object-oriented language, that allow an attacker to cause denial of service, trafic redirection, header injection and cross-site scripting. CVE-2013-1753: The gzip_decode function in the xmlrpc client library allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request. CVE-2016-1000110:The CGIHandler class does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. CVE-2019-16935:The documentation XML-RPC server has XSS via the server_title field. This occurs in Lib/xmlrpc/server.py. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. CVE-2019-18348: In urllib2, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. CVE-2020-14422: Lib/ipaddress.py improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. Vulnerable: <= 3.4.2-1+deb8u7 Fixed: 3.4.2-1+deb8u8 | 3.7.12 |
| 2551778 CM-30531 | Several vulnerabilities where found in Perl’s regular expression compiler. An application that compiles untrusted regular expressions could be exploited to cause denial of service or code injection. It is discouraged to allow untrusted regular expressions to be compiled by Perl. CVE-2020-10543: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. CVE-2020-10878: Perl before 5.30.3 has an integer overflow related to mishandling of a “PL_regkind[OP(n)] == NOTHING” situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. CVE-2020-12723: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Vulnerable: <= 5.20.2-3+deb8u12 Fixed: 5.20.2-3+deb8u13 | 3.7.12 |
| 2551708 CM-30494 | On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | |
| 2551543 CM-30403 | switchd might crash if more than 16 IPv6 default route next hops are installed in the kernel routing table and those 16 next hops recurse to MAC address table entries reachable over VXLAN VNI interfaces. This can occur when many IPv6 router advertisements (RAs) are received across VLAN interfaces that have IPv6 forwarding disabled.To work around this issue, add the following parameters to the /etc/sysctl.conf file to disable IPv6 default route installation from received router advertisements, then run the sudo sysctl -p –system command.
| 3.7.12 |
| 2551395 CM-30343 | The libnss3 package, available for optional installation on Cumulus Linux, has the following vulnerabilities:CVE-2020-12399: Timing differences when performing DSA signatures. CVE-2020-12402: Side channel vulnerabilities during RSA key generation. Vulnerable: <= 3.26-1+deb8u10 Fixed: 3.26-1+deb8u11 | 3.7.12 |
| 2551356 CM-30325 | The following vulnerabilities have been announced in the qemu package, which is available in the repository for optional installation on Cumulus Linux:CVE-2020-1983: slirp: Fix use-after-free in ip_reass(). CVE-2020-13361: es1370_transfer_audio in hw/audio/es1370.c allowed guest OS users to trigger an out-of-bounds access during an es1370_write() operation. CVE-2020-13362: megasas_lookup_frame in hw/scsi/megasas.c had an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. CVE-2020-13765: hw/core/loader: Fix possible crash in rom_copy(). Vulnerable: <= 2.1+dfsg-12+deb8u14 Fixed: 2.1+dfsg-12+deb8u15 | 3.7.12 |
| 2551351 CM-30321 | CVE-2018-6381 CVE-2018-6484 CVE-2018-6540 CVE-2018-6541 CVE-2018-6869 CVE-2018-7725 CVE-2018-7726 CVE-2018-16548 Several issues have been fixed in zziplib, a library providing read access on ZIP-archives. They are all related to invalid memory access and resulting crash or memory leak.libzzip-0-13 is not installed by default on Cumulus Linux, but is available in the repository for optional installation. Vulnerable: <= 0.13.62-3+deb8u1 Fixed: 0.13.62-3+deb8u2 | 3.7.12 |
| 2551350 CM-30320 | CVE-2017-10790: The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack. Vulnerable: <= 4.2-3+deb8u3 Fixed: 4.2-3+dev8u4 | 3.7.12 |
| 2551259 CM-30274 | CVE-2016-2774: ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. On Cumulus Linux, the isc-dhcp-server is installed by default, but is not enabled by default. Vulnerable: <= 4.3.1-6-cl3u14 Fixed: 4.3.1-6-cl3u15 | 3.7.12 |
| 2551162 CM-30240 | switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. | 3.7.11-3.7.12, 4.0.0-4.2.0 |
| 2550735 CM-30064 | The following security vulnerability has been found in BlueZ, in which the libbluetooth3 library is available in the repository for optional installation in Cumulus Linux:CVE-2020-0556: Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access. Vulnerable: <= 5.23-2+deb8u1 Fixed: 5.43-2+deb9u2~deb8u1 | 3.7.12 |
| 2550693 CM-30040 | The following vulnerabilities have been announced in the cups package:CVE-2019-8842: The ‘ippReadIO’ function may under-read an extension field CVE-2020-3898: heap based buffer overflow in libcups’s ppdFindOption() in ppd-mark.c Vulnerable: <= 1.7.5-11+deb8u7 Fixed: 1.7.5-11+deb8u8 | 3.7.12 |
| 2550647 CM-30009 | CVE-2020-12049: There was a file descriptor leak in the D-Bus message bus. An unprivileged local attacker could use this to attack the system DBus daemon, leading to denial of service for all users of the machine. Vulnerable: <= 1.8.22-0+deb8u2 Fixed: 1.8.22-0+deb8u3 | 3.7.12 |
| 2550512 CM-29922 | The python-httplib2 package, which is available in the repository for optional installation, has the following vulnerability:CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for ‘httplib2.Http.request()’ could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. Vulnerable: 0.9+dfsg-2 Fixed: 0.9+dfsg-2+deb8u1 | 3.7.12 |
| 2550511 CM-29921 | The following vulnerabilities have been announced in dosfstools, which is available in the repository for optional installation:CVE-2015-8872: The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an “off-by-two error." CVE-2016-4804: The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function. Vulnerable: 3.0.27-1 Fixed: 3.0.27-1+deb8u1 | 3.7.12 |
| 2550509 CM-29920 | The json-c shared library (libjson-c2) had an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. The libjson-c2 library is installed by default on Cumulus Linux 3.x.Vulnerable: <= 0.11-4 Fixed: 0.11-4+deb8u2 | 3.7.12 |
| 2550507 CM-29919 | Several vulnerabilities were discovered in BIND, a DNS server implementation.bind9-host (containing only /usr/bin/host) and some libraries from the bind9 source package are installed on the switch by default; the BIND server referred to in these vulnerabilities is not installed by default but is available in the repository for optional installation.CVE-2020-8616: It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. CVE-2020-8617: It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service. Vulnerable: <= 1:9.9.5.dfsg-9+deb8u18 Fixed: 1:9.9.5.dfsg-9+deb8u19 | 3.7.12 |
| 2550367 CM-29834 | The following security vulnerability has been announced: CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.Vulnerable: <= 3.8.7.1-1+deb8u5 Fixed: 3.8.7.1-1+deb8u6 | 3.7.12 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 |
| 2550275 CM-29778 | If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. | 3.7.12, 4.0.0-4.1.1 |
| 2550119 CM-29692 | The following vulnerability has been announced in the apt package:CVE-2020-3810: Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files. Vulnerable: <= 1.0.9.8.5-cl3u1 Fixed: 1.0.9.8.5-cl3u2 | 3.7.12 |
| 2549869 CM-29559 | The following vulnerability has been announced: CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object’s initialization is mishandled. Vulnerable: <= 3.8.7.1-1+deb8u4 Fixed: 3.8.7.1-1+deb8u5 | 3.7.12 |
| 2549835 CM-29544 | The following vulnerability affects the openldap package: CVE-2020-12243: A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash). Vulnerable: <= 2.4.40+dfsg-1+deb8u5 Fixed: 2.4.40+dfsg-1+deb8u6 | 3.7.12 |
| 2549781 CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.7.12 |
| 2549777 CM-29514 | The following security vulnerabilities were announced in the w3m package, which is available in the repository for optional installation: CVE-2018-6196: w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prevent a negative indent value. CVE-2018-6197: w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c. Vulnerable: <= 0.5.3-19+deb8u2 Fixed: 0.5.3-19+deb8u3 | 3.7.12 |
| 2549711 CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.7.12 |
| 2549710 CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.7.12 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 |
| 2549397 CM-29322 | When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12 |
| 2549348 CM-29297 | The following vulnerability has been announced in git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Vulnerable: <= 2.1.4-2.1+deb8u8 (CVE-2020-5260) <= 2.1.4-2.1+deb8u9 (CVE-2020-11008) Fixed: 2.1.4-2.1+deb8u10 | 3.7.12 |
| 2549307 CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.7.12, 4.0.0-4.1.1 |
| 2549110 CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.7.12 |
| 2548678 CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.7.12 |
| 2548674 CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2548666 CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.7.12 |
| 2548659 CM-29037 | When a link flap occurs while IPv6 traffic traverses interfaces, a kernel panic may occur with the following logs printed to the console:
| 3.7.12 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 |
| 2548580 CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.7.12 |
| 2548579 CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.7.12, 4.0.0-4.1.0 |
| 2548505 CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.7.12 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 |
| 2548373 CM-28862 | On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 |
| 2548309 CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.7.12 |
| 2548308 CM-28810 | When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. | 3.7.11-3.7.12, 4.1.0-4.1.1 |
| 2548116 CM-28658 | The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12, 4.0.0-4.0.1 |
| 2548113 CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2547880 CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access. CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 Vulnerable: <= 3.0pl1-cl3u1 Fixed: 3.0pl1-cl3u2 | 3.7.12 |
| 2547879 CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br />The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration.Vulnerable: <= 8.4.2-1-cl3u5 Fixed: 8.4.2-1-cl3u6 | 3.7.12 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 |
| 2547667 CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 |
| 2547658 CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 |
| 2547610 CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2547592 CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 |
| 2547401 CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.7.11-3.7.12 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2547147 CM-28086 | The ospfd daemon might crash with the following kernel trace:
| 3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 |
| 2546267 CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.7.10-3.7.12 |
| 2546141 CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. | 3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 |
| 2535845 CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 4.0.0-4.0.1 |
3.7.12 Release Notes
Open issues in 3.7.12
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 | 3.7.14.2, 4.3.0 |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556061 CM-33032 | On Edgecore AS4610 switches, the historic CPU usage displayed in /run/sysmonitor/history is sometimes shown as a negative value. | 3.7.12-3.7.14.2, 4.2.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554719 CM-32225 | A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. | 3.7.12-3.7.14.2 | |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554329 CM-31978 | On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. | 3.7.12-3.7.14.2 | |
| 2554232 CM-31929 | VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553732 CM-31618 | A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553588 CM-31565 | Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 | 3.7.14, 4.3.0 |
| 2553450 CM-31504 | On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. | 3.7.12-3.7.13, 4.2.1 | 3.7.14, 4.3.0 |
| 2553229 CM-31412 | On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-3.7.13, 4.2.1 | 3.7.14, 4.3.0 |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2553050 CM-31322 | SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. | 3.7.12-3.7.14.2 | |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2553001 CM-31294 | When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094):* clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2, 4.2.0-4.3.0 |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552925 CM-31257 | On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552647 CM-31086 | When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. | 3.7.10-3.7.13, 4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552236 CM-30845 | The following vulnerabilities were reported against qemu, which is available in the repository for optional installation:CVE-2020-13659: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. Vulnerable: <= 2.1+dfsg-12+deb8u15 Fixed: 2.1+dfsg-12+deb8u16 | 3.7.12-3.7.13 | 3.7.14-3.7.14.2 |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 | 3.7.14.2 |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2552206 CM-30827 | If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552187 CM-30818 | The following vulnerabilities have been announced in librsvg, which is available in the repository for optional installation:CVE-2016-6163: The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file. CVE-2019-20446: In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially. Vulnerable: <= 2.40.5-1+deb8u2 Fixed: 2.40.5-1+deb8u3 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551916 CM-30582 | The following vulnerability has been announced in glib-networking, which is not installed by default, but is available in the repository for optional installation. CVE-2020-13645: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Vulnerable: 2.42.0-2 Fixed: 2.42.0-2+deb8u1 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551915 CM-30581 | The following vulnerabilities have been announced in NGINX, which is installed by default on Cumulus Linux (however, the default nginx configuration is not vulnerable, since it does not configure error_page redirection or use lua): CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. CVE-2020-11724: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. Vulnerable: <= 1.6.2-5+deb8u6 Fixed: 1.6.2-5+deb8u7 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551780 CM-30533 | CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice. Vulnerable: <= 2.1.0-2+deb8u10 Fixed: 2.1.0-2+deb8u11 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551779 CM-30532 | Several issues were discovered in Python 3.4, an interactive high-level object-oriented language, that allow an attacker to cause denial of service, trafic redirection, header injection and cross-site scripting. CVE-2013-1753: The gzip_decode function in the xmlrpc client library allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request. CVE-2016-1000110:The CGIHandler class does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. CVE-2019-16935:The documentation XML-RPC server has XSS via the server_title field. This occurs in Lib/xmlrpc/server.py. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. CVE-2019-18348: In urllib2, CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. CVE-2020-14422: Lib/ipaddress.py improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. Vulnerable: <= 3.4.2-1+deb8u7 Fixed: 3.4.2-1+deb8u8 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551778 CM-30531 | Several vulnerabilities where found in Perl’s regular expression compiler. An application that compiles untrusted regular expressions could be exploited to cause denial of service or code injection. It is discouraged to allow untrusted regular expressions to be compiled by Perl. CVE-2020-10543: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. CVE-2020-10878: Perl before 5.30.3 has an integer overflow related to mishandling of a “PL_regkind[OP(n)] == NOTHING” situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. CVE-2020-12723: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Vulnerable: <= 5.20.2-3+deb8u12 Fixed: 5.20.2-3+deb8u13 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551748 CM-30514 | In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2551732 CM-30504 | When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551729 CM-30503 | In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551715 CM-30498 | There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551693 CM-30486 | A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. | 3.7.12-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551651 CM-30464 | The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551543 CM-30403 | switchd might crash if more than 16 IPv6 default route next hops are installed in the kernel routing table and those 16 next hops recurse to MAC address table entries reachable over VXLAN VNI interfaces. This can occur when many IPv6 router advertisements (RAs) are received across VLAN interfaces that have IPv6 forwarding disabled.To work around this issue, add the following parameters to the /etc/sysctl.conf file to disable IPv6 default route installation from received router advertisements, then run the sudo sysctl -p –system command.
| 3.7.12 | 3.7.13-3.7.14.2 |
| 2551395 CM-30343 | The libnss3 package, available for optional installation on Cumulus Linux, has the following vulnerabilities:CVE-2020-12399: Timing differences when performing DSA signatures. CVE-2020-12402: Side channel vulnerabilities during RSA key generation. Vulnerable: <= 3.26-1+deb8u10 Fixed: 3.26-1+deb8u11 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551356 CM-30325 | The following vulnerabilities have been announced in the qemu package, which is available in the repository for optional installation on Cumulus Linux:CVE-2020-1983: slirp: Fix use-after-free in ip_reass(). CVE-2020-13361: es1370_transfer_audio in hw/audio/es1370.c allowed guest OS users to trigger an out-of-bounds access during an es1370_write() operation. CVE-2020-13362: megasas_lookup_frame in hw/scsi/megasas.c had an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. CVE-2020-13765: hw/core/loader: Fix possible crash in rom_copy(). Vulnerable: <= 2.1+dfsg-12+deb8u14 Fixed: 2.1+dfsg-12+deb8u15 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551351 CM-30321 | CVE-2018-6381 CVE-2018-6484 CVE-2018-6540 CVE-2018-6541 CVE-2018-6869 CVE-2018-7725 CVE-2018-7726 CVE-2018-16548 Several issues have been fixed in zziplib, a library providing read access on ZIP-archives. They are all related to invalid memory access and resulting crash or memory leak.libzzip-0-13 is not installed by default on Cumulus Linux, but is available in the repository for optional installation. Vulnerable: <= 0.13.62-3+deb8u1 Fixed: 0.13.62-3+deb8u2 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551350 CM-30320 | CVE-2017-10790: The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack. Vulnerable: <= 4.2-3+deb8u3 Fixed: 4.2-3+dev8u4 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2551259 CM-30274 | CVE-2016-2774: ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. On Cumulus Linux, the isc-dhcp-server is installed by default, but is not enabled by default. Vulnerable: <= 4.3.1-6-cl3u14 Fixed: 4.3.1-6-cl3u15 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2551162 CM-30240 | switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. | 3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550735 CM-30064 | The following security vulnerability has been found in BlueZ, in which the libbluetooth3 library is available in the repository for optional installation in Cumulus Linux:CVE-2020-0556: Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access. Vulnerable: <= 5.23-2+deb8u1 Fixed: 5.43-2+deb9u2~deb8u1 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550693 CM-30040 | The following vulnerabilities have been announced in the cups package:CVE-2019-8842: The ‘ippReadIO’ function may under-read an extension field CVE-2020-3898: heap based buffer overflow in libcups’s ppdFindOption() in ppd-mark.c Vulnerable: <= 1.7.5-11+deb8u7 Fixed: 1.7.5-11+deb8u8 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550647 CM-30009 | CVE-2020-12049: There was a file descriptor leak in the D-Bus message bus. An unprivileged local attacker could use this to attack the system DBus daemon, leading to denial of service for all users of the machine. Vulnerable: <= 1.8.22-0+deb8u2 Fixed: 1.8.22-0+deb8u3 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550512 CM-29922 | The python-httplib2 package, which is available in the repository for optional installation, has the following vulnerability:CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for ‘httplib2.Http.request()’ could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. Vulnerable: 0.9+dfsg-2 Fixed: 0.9+dfsg-2+deb8u1 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550511 CM-29921 | The following vulnerabilities have been announced in dosfstools, which is available in the repository for optional installation:CVE-2015-8872: The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an “off-by-two error." CVE-2016-4804: The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function. Vulnerable: 3.0.27-1 Fixed: 3.0.27-1+deb8u1 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550509 CM-29920 | The json-c shared library (libjson-c2) had an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. The libjson-c2 library is installed by default on Cumulus Linux 3.x.Vulnerable: <= 0.11-4 Fixed: 0.11-4+deb8u2 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550507 CM-29919 | Several vulnerabilities were discovered in BIND, a DNS server implementation.bind9-host (containing only /usr/bin/host) and some libraries from the bind9 source package are installed on the switch by default; the BIND server referred to in these vulnerabilities is not installed by default but is available in the repository for optional installation.CVE-2020-8616: It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. CVE-2020-8617: It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service. Vulnerable: <= 1:9.9.5.dfsg-9+deb8u18 Fixed: 1:9.9.5.dfsg-9+deb8u19 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550466 CM-29890 | Multiple paths to identical EVPN prefixes are either not displayed or not accepted into the l2vpn evpn table if they are received from a different AS. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550367 CM-29834 | The following security vulnerability has been announced: CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.Vulnerable: <= 3.8.7.1-1+deb8u5 Fixed: 3.8.7.1-1+deb8u6 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550275 CM-29778 | If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550196 CM-29740 | The exim4 package available for optional installation on Cumulus Linux 3.x has the following vulnerability:DLA-2213-1 / CVE-2020-12783: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. The spa authentication driver is not enabled by default. Vulnerable: <= 4.84.2-2+deb8u6 Fixed: 4.84.2-2+deb8u7 | 3.7.12-3.7.14.2 | |
| 2550119 CM-29692 | The following vulnerability has been announced in the apt package:CVE-2020-3810: Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files. Vulnerable: <= 1.0.9.8.5-cl3u1 Fixed: 1.0.9.8.5-cl3u2 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2550056 CM-29652 | The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549872 CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549869 CM-29559 | The following vulnerability has been announced: CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object’s initialization is mishandled. Vulnerable: <= 3.8.7.1-1+deb8u4 Fixed: 3.8.7.1-1+deb8u5 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549835 CM-29544 | The following vulnerability affects the openldap package: CVE-2020-12243: A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash). Vulnerable: <= 2.4.40+dfsg-1+deb8u5 Fixed: 2.4.40+dfsg-1+deb8u6 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549794 CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
| 3.7.11-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549781 CM-29518 | The following vulnerability affects the ruby2.1 package, which is installed by default: CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.1 has an unsafe object creation vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Vulnerable: 2.1.5-2+deb8u9 Fixed: 2.1.5-2+deb8u10 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549777 CM-29514 | The following security vulnerabilities were announced in the w3m package, which is available in the repository for optional installation: CVE-2018-6196: w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prevent a negative indent value. CVE-2018-6197: w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c. Vulnerable: <= 0.5.3-19+deb8u2 Fixed: 0.5.3-19+deb8u3 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549731 CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549711 CM-29484 | The following vulnerability affects libgd2/libgd3: CVE-2018-14553: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Vulnerable: <= 2.1.0-5+deb8u13 Fixed: 2.1.0-5+deb8u14 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549710 CM-29483 | The following vulnerability affects imptool: CVE-2020-5208: It’s been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. Vulnerable: <= 1.8.14-4 Fixed: 1.8.14-4+deb8u1 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549397 CM-29322 | When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549348 CM-29297 | The following vulnerability has been announced in git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Vulnerable: <= 2.1.4-2.1+deb8u8 (CVE-2020-5260) <= 2.1.4-2.1+deb8u9 (CVE-2020-11008) Fixed: 2.1.4-2.1+deb8u10 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2549307 CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2549110 CM-29208 | The following vulnerability has been announced in ceph; the associated libraries librados2 and librbd1 are available in the Cumulus Linux 3 repository for optional installation. CVE-2020-1760: It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. Vulnerable: <= 0.80.7-2+deb8u2 Fixed: 0.80.7-2+deb8u4 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548678 CM-29048 | The following vulnerability exists in the ruby2.1 package: CVE-2016-2338: An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer “head” allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow Vulnerable: <= 2.1.5-2+deb8u8 Fixed: 2.1.5-2+deb8u9 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548674 CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548666 CM-29040 | The following issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities:CVE-2019-5188: A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548659 CM-29037 | When a link flap occurs while IPv6 traffic traverses interfaces, a kernel panic may occur with the following logs printed to the console:
| 3.7.12 | 3.7.13-3.7.14.2 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548580 CM-28993 | The following security vulnerability has been announced that affects the libicu52 package: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Vulnerable: <= 52.1-8+deb8u7 Fixed: 52.1-8+deb8u8 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548579 CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.7.12, 4.0.0-4.1.0 | 3.7.13-3.7.14, 4.1.1-4.3.0 |
| 2548505 CM-28954 | The python-twisted-* packages, which are available for optional installation in Cumulus Linux but are not installed by default, were found to have the following security vulnerabilities: CVE-2020-10808: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. CVE-2020-10809: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548373 CM-28862 | On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548309 CM-28811 | The following security vulnerability affects the libvpx1 library:CVE-2020-0034: It was discovered that there was an out-of-bounds buffer read vulnerability in libvpx, a library implementing the VP8 & VP9 videocodecs. | 3.7.12 | 3.7.13-3.7.14.2 |
| 2548308 CM-28810 | When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. | 3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548116 CM-28658 | The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2548113 CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547880 CM-28488 | The following CVEs were announced that affect the cron package. All of these require untrusted local user access. CVE-2017-9525 is a local user privilege escalation attack: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. CVE-2019-9704, CVE-2019-9705, CVE-2019-9706 are local user denial of service attacks. Note: the fix for CVE-2019-9705 imposes a limitation on the length of a crontab file (the vulnerability was that an unlimited size crontab file could cause excessive memory consumption). https://security-tracker.debian.org/tracker/DLA-1723-1 Vulnerable: <= 3.0pl1-cl3u1 Fixed: 3.0pl1-cl3u2 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2547879 CM-28487 | The following CVE was announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages and using optional pmaixforwardedfrom or pmcisconames parser modules (not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows.Do not enable (with $UDPServerRun or $InputTCPServerRun) receiving syslog messages from other hosts by the network. Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames.<br />The default /etc/rsyslog.conf file on Cumulus Linux does NOT enable $UDPServerRun or $InputTCPServerRun, so the vulnerability is not network exploitable in the default configuration. In addition, the vulnerable parsers are not enabled in the default configuration.Vulnerable: <= 8.4.2-1-cl3u5 Fixed: 8.4.2-1-cl3u6 | 3.7.12 | 3.7.13-3.7.14.2 |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547799 CM-28451 | An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. | 3.7.11-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 | 3.7.13-3.7.14.2 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547667 CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547658 CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | 3.7.13-3.7.14.2 |
| 2547610 CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547592 CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 | 3.7.13-3.7.14.2, 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547401 CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.7.11-3.7.12 | 3.7.13-3.7.14.2 |
| 2547381 CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
| 3.7.11-3.7.14 | 4.0.0-4.3.0 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547147 CM-28086 | The ospfd daemon might crash with the following kernel trace:
| 3.7.11-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547120 CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2546992 CM-28004 | The wireshark packages (libwireshark5, libwireshark-data, wireshark, wireshark-common) available for optional installation on Cumulus Linux 3 are vulnerable to CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. More information at https://www.wireshark.org/security/wnpa-sec-2018-50.html and https://security-tracker.debian.org/tracker/CVE-2018-12086 . | 3.7.11-3.7.14.2 | |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546989 CM-28001 | The libxen packages are not installed on the switch by default, but are available in the repository for optional installation. Customers who optionally install the libxen packages should be aware of the following security advisory. Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. For more information, see https://security-tracker.debian.org/tracker/xen | 3.7.11-3.7.14.2 | |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546848 CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.7.11-3.7.14.2 | |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546267 CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.7.10-3.7.12 | 3.7.13-3.7.14.2 |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546203 CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. | 3.7.11-3.7.14.2 | |
| 2546141 CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. | 3.7.11-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 | 3.7.14-3.7.14.2, 4.1.0-4.3.0 |
| 2545566 CM-27272 | The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537823 CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability." Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.7.11-3.7.14.2 | |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
Fixed Issues in 3.7.12
| Issue ID | Description | Affects |
|---|---|---|
| 2547878 CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library.CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.7.11 |
| 2547876 CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.7.11 |
| 2547874 CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.7.11 |
| 2547558 CM-28313 | On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. | 3.7.11, 4.0.0-4.0.1 |
| 2547509 CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2547400 CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.7.11 |
| 2547303 CM-28169 | On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11, 4.0.0-4.0.1 |
| 2547155 CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.7.11 |
| 2547149 CM-28087 | The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11, 4.0.0-4.0.1 |
| 2547122 CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2547106 CM-28065 | Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 |
| 2547071 CM-28048 | On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11, 4.0.0-4.0.1 |
| 2547043 CM-28038 | After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. | 3.7.11, 4.0.0-4.0.1 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546815 CM-27927 | On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:
To work around this issue, run the net show system sensors json command instead. | 3.7.11 |
| 2546810 CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.7.11 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546564 CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 |
| 2546502 CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 |
| 2546354 CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.7.11 |
| 2546329 CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546265 CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546003 CM-27525 | On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 |
| 2545972 CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 |
| 2545949 CM-27496 | All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. | 3.7.11, 4.0.0-4.0.1 |
| 2545837 CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. | 3.7.10-3.7.11, 4.0.0-4.3.0 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 |
| 2545316 CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. | 3.7.9-3.7.11 |
| 2544937 CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 |
| 2544854 CM-26839 | On the Dell S5248F-ON switch, CPU core temp sensors may show as ABSENT. | 4.0.0-4.0.1 |
| 2544012 CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 |
| 2543903 CM-26291 | The Dell N3048EP, N3048UP, and N3248PXE switches do not report the class correctly when the powered device (PD) requests a class that is greater than four. The actual power grant is correct; however, poectl displays the class as 4 for a PD requesting anything above that value. | |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 |
| 2536617 CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:
| 3.7.0-3.7.11, 4.0.0-4.0.1 |
3.7.11 Release Notes
Open issues in 3.7.11
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 | 3.7.14.2, 4.3.0 |
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 | 3.7.14, 4.3.0 |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552647 CM-31086 | When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. | 3.7.10-3.7.13, 4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 | 3.7.14.2 |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2551162 CM-30240 | switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. | 3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2549794 CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
| 3.7.11-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548674 CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548308 CM-28810 | When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. | 3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547878 CM-28486 | The following vulnerability has been found in the libgcrypt20 cryptographic library.CVE-2019-13627: there was a ECDSA timing attack. For more information, see https://www.debian.org/lts/security/2020/dla-1931-2.en.html Vulnerable: 1.6.3-2+deb8u7 Fixed: 1.6.3-2+deb8u8 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547876 CM-28485 | The following vulnerability affects libxml2: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c has a memory leak related to newDoc->oldNs. This can lead to a denial of service. For more information, see https://www.debian.org/lts/security/2019/dla-2048.en.html . Vulnerable: 2.9.1+dfsg1-5+deb8u7 Fixed: 2.9.1+dfsg1-5+deb8u8 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547874 CM-28484 | The following vulnerability affects libbsd, a package containing utility functions from BSD systems. CVE-2016-2090: In function fgetwln() an off-by-one error could triggers a heap buffer overflow. For more information, see https://www.debian.org/lts/security/2019/dla-2052.en.html . Vulnerable: 0.7.0-2 Fixed: 0.7.0-2+deb8u1 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547799 CM-28451 | An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. | 3.7.11-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 | 3.7.13-3.7.14.2 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547667 CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547658 CM-28371 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | 3.7.13-3.7.14.2 |
| 2547610 CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547592 CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 | 3.7.13-3.7.14.2, 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547558 CM-28313 | On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547509 CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547401 CM-28223 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-1711: block: iscsi: OOB heap access via an unexpected response of iSCSI Server | 3.7.11-3.7.12 | 3.7.13-3.7.14.2 |
| 2547400 CM-28222 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Vulnerable: <= 2.1+dfsg-12+deb8u12 Fixed: 2.1+dfsg-12+deb8u13 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547381 CM-28212 | The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
| 3.7.11-3.7.14 | 4.0.0-4.3.0 |
| 2547303 CM-28169 | On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547155 CM-28091 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, refer to https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 0.9.3.12 Fixed: 0.9.3.13 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547149 CM-28087 | The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547147 CM-28086 | The ospfd daemon might crash with the following kernel trace:
| 3.7.11-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547122 CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547120 CM-28076 | After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2547106 CM-28065 | Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 | 3.7.12-3.7.14.2 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547071 CM-28048 | On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2547043 CM-28038 | After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2546992 CM-28004 | The wireshark packages (libwireshark5, libwireshark-data, wireshark, wireshark-common) available for optional installation on Cumulus Linux 3 are vulnerable to CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. More information at https://www.wireshark.org/security/wnpa-sec-2018-50.html and https://security-tracker.debian.org/tracker/CVE-2018-12086 . | 3.7.11-3.7.14.2 | |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546989 CM-28001 | The libxen packages are not installed on the switch by default, but are available in the repository for optional installation. Customers who optionally install the libxen packages should be aware of the following security advisory. Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. For more information, see https://security-tracker.debian.org/tracker/xen | 3.7.11-3.7.14.2 | |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546848 CM-27937 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 One of the listed vulnerabilities is still present in the latest upstream version 2.1+dfsg-12+deb8u12 (the others have been fixed): CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. https://security-tracker.debian.org/tracker/CVE-2017-15124 | 3.7.11-3.7.14.2 | |
| 2546815 CM-27927 | On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:
To work around this issue, run the net show system sensors json command instead. | 3.7.11 | 3.7.12-3.7.14.2 |
| 2546810 CM-27924 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.26.dfsg1-13+deb8u1 Fixed: 2.1.26.dfsg1-13+deb8u2 | 3.7.11 | 3.7.12-3.7.14.2 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2546564 CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 | 3.7.12-3.7.14.2 |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
| 2546502 CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546451 CM-27737 | On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546354 CM-27683 | The following CVEs were announced that affect the Linux kernel: CVE-2019-12378: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). CVE-2019-15239: In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. CVE-2019-19537: In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. | 3.7.11 | 3.7.12-3.7.14.2 |
| 2546329 CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546267 CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.7.10-3.7.12 | 3.7.13-3.7.14.2 |
| 2546265 CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546203 CM-27620 | When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. | 3.7.11-3.7.14.2 | |
| 2546141 CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. | 3.7.11-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2546003 CM-27525 | On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 | 3.7.12-3.7.14.2 |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545972 CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2545949 CM-27496 | All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2545837 CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. | 3.7.10-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 | 3.7.14-3.7.14.2, 4.1.0-4.3.0 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2545316 CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12-3.7.14.2 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544937 CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544012 CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537823 CM-23125 | The OpenSSL package on Cumulus Linux 3.x has a vulnerability similar to CVE-2018-0734. (The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key). According to Debian upstream, this version “is not vulnerable [to CVE-2018-0734 exactly]. Nevertheless, there is a bug fix that futher reduces the amount of leaked timing information. It got no CVE on its own and introduced this vulnerability." Vulnerable on CL3: 1.0.1t-1+deb8u12 | 3.7.11-3.7.14.2 | |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536617 CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:
| 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 | 4.1.0-4.3.0 |
Fixed Issues in 3.7.11
| Issue ID | Description | Affects |
|---|---|---|
| 2547912 CM-28511 | The following vulnerabilities were discovered in cURL, an URL transfer library. CVE-2019-5436: A heap buffer overflow in the TFTP receiving code was discovered, which could allow DoS or arbitrary code execution. CVE-2019-5482: Thomas Vegas discovered a heap buffer overflow that could be triggered when a small non-default TFTP blocksize is used. Vulnerable: 7.38.0-4+deb8u15 Fixed: 7.38.0-4+deb8u16 | 3.7.10 |
| 2547402 CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.7.10 |
| 2547118 CM-28074 | The following security vulnerabilities have been announced in the libtiff5 library on Cumulus Linux 4.0: CVE-2019-14973, CVE-2019-17546: Multiple integer overflows have been discovered in the libtiff library and the included tools. Vulnerable: 4.0.10-4 Fixed: 4.1.0+git191117-2~deb10u1 | 3.7.10, 4.0.0-4.0.1 |
| 2546228 CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.7.10 |
| 2545868 CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545866 CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545694 CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 |
| 2545644 CM-27321 | The following CVEs were announced that affect the ghostscript package: CVE-2019-14869: Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. Cumulus Linux 3: <= 9.26a~dfsg-0+deb8u5 vulnerable, >= 9.26a~dfsg-0+deb8u6 fixed. https://security-tracker.debian.org/tracker/ghostscript https://security-tracker.debian.org/tracker/CVE-2019-14869 | 3.7.10 |
| 2545608 CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545563 CM-27269 | The following Linux kernel security vulnerabilities do not affect Cumulus Linux in supported configurations: CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135 Several vulnerabilities have been discovered in the Linux kernel that may may to a privilege escalation, denial of service, or information leak. CVE-2018-12207: Intel CPU hypervisor vulnerability. Running hypervisors on Cumulus Linux is not supported. CVE-2019-0154, CVE-2019-0155: Intel GPU vulnerabilities. GPUs are not present on our switches. CVE-2019-11135, CVE-2019-11139: Intel CPU transactional memory vulnerability. None of our switches support transactional memory. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | |
| 2545520 CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.3.0 |
| 2545505 CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 |
| 2545448 CM-27193 | The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. | 3.7.10, 4.0.0-4.0.1 |
| 2545405 CM-27174 | The ospfd daemon might crash with the following kernel trace:
| 3.7.6-3.7.10 |
| 2545236 CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545133 CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545087 CM-26996 | On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. | 3.7.10, 4.0.0-4.0.1 |
| 2545049 CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545027 CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 |
| 2545019 CM-26947 | The following CVEs affect the OpenLDAP utilities: CVE-2019-13057 CVE-2019-13565 For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-13565 https://security-tracker.debian.org/tracker/CVE-2019-13057 Vulnerable versions: < 2.4.40+dfsg-1+deb8u5 Fixed versions: >= 2.4.40+dfsg-1+deb8u5 | |
| 2544867 CM-26849 | Package: tcpdump CVE ID: CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code. For the detailed security status of tcpdump, refer to its security tracker page at: https://security-tracker.debian.org/tracker/tcpdump Fixed versions: 4.9.3-1~deb10u1 on Cumulus Linux 4, 4.9.3-1~deb8u1 on Cumulus Linux 3. | 3.7.10 |
| 2544847 CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10, 4.0.0-4.0.1 |
| 2544815 CM-26815 | If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 |
| 2544625 CM-26703 | VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2544609 CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.10 |
| 2544559 CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.10 |
| 2544401 CM-26566 | Package: openssl CVE ID: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563 Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default. Fixed version: 1.1.1d-0+deb10u1 We recommend that you upgrade your openssl packages. For the detailed security status of openssl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl | 3.7.0-3.7.10 |
| 2544385 CM-26556 | The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 |
| 2544329 CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:
| 4.0.0-4.0.1 |
| 2544324 CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 |
| 2544213 CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2544200 CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2544182 CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 |
| 2544057 CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 |
| 2543875 CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 |
| 2543835 CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 |
| 2543727 CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. | 3.7.3-3.7.10 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 |
| 2543708 CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 |
| 2543690 CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 |
| 2543665 CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 |
| 2543560 CM-26082 | The following vulnerabilities are only applicable if qemu is installed from the repo mirror. It is not present in the base image by default, so base images without qemu installed are not vulnerable. CVE-2018-20815 CVE-2019-13164 CVE-2019-14378: Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs. Cumulus Linux 3: >= 2.1+dfsg-12+deb8u12 fixed. https://security-tracker.debian.org/tracker/qemu https://security-tracker.debian.org/tracker/CVE-2018-20815 https://security-tracker.debian.org/tracker/CVE-2019-13164 https://security-tracker.debian.org/tracker/CVE-2019-14378 | 3.7.10 |
| 2543374 CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 |
| 2543325 CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 |
| 2543113 CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 |
| 2542958 CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 |
| 2542913 CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 |
| 2542885 CM-25704 | The following CVEs affect the linux package: CVE-2019-13272 It was discovered that the ptrace subsystem in the Linux kernel mishandles the management of the credentials of a process that wants to create a ptrace relationship, allowing a local user to obtain root privileges under certain scenarios. Cumulus Linux is not affected. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-13272 | |
| 2542872 CM-25693 | After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2542835 CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 |
| 2542765 CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 |
| 2542510 CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10, 4.0.0-4.0.1 |
| 2542384 CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 |
| 2542248 CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:
| 3.7.6-3.7.10 |
| 2542065 CM-25298 | The following CVEs were announced in a Debian Security Advisory that affects vim modelines. Package: vim and neovim CVE ID: CVE-2019-12735 Debian Bugs: 930020, 930024 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-12735 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12735.html https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md Cumulus Networks recommends that you disable modelines in the the vimrc file (set nomodeline) to use the securemodelines plugin or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines.To check if you have modelines enabled, open vim and enter: :set modeline? If vim returns nomodeline, you are not vulnerable. If you are vulnerable or you want to ensure your security with this issue, add these lines to your vimrc file:
modeline is enabled by default. Verify that you do not have any existing lines in .vimrc that set modelines or modeline. | |
| 2537536 CM-23016 | When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 |
| 2536639 CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. | 3.7.0-3.7.10 |
| 2536559 CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. | 3.7.3-3.7.10 |
| 2536231 CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2535306 CM-21373 | Debian issued the following security advisory, DSA-4231-1, which affects the libgcrypt20 package. This advisory applies only to the the Debian Stretch release. Debian Jessie, upon which Cumulus Linux 3.0 - 3.6.2 is based, is vulnerable. CVE-2018-0495 It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys. For the stable distribution (stretch), this problem has been fixed in version 1.7.6-2+deb9u3. We recommend that you upgrade your libgcrypt20 packages. For the detailed security status of libgcrypt20, refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 | |
| 2535209 CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.7.5-3.7.10, 4.0.0-4.3.0 |
| 2534450 CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 |
| 2534040 CM-20132 | On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | |
| 2532593 CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | |
| 2528990 CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. | 3.7.6-3.7.10 |
| 2526985 CM-13316 | When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. |
3.7.10 Release Notes
Open issues in 3.7.10
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-28462 | On rare occasions, when you upgrade Cumulus Linux with the apt-get upgrade command, the upgrade fails and reports No space left on device. Checking the disk utilization shows that the disk is not full.To work around this issue, run the apt-get upgrade command again and reboot the device if prompted to complete the upgrade. | 3.7.10-3.7.14.2 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2562511 | hostapd} does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-Requests | 3.7.10-3.7.14.2 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 | 3.7.14, 4.3.0 |
| 2553015 CM-31300 | If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. | 3.7.10-3.7.14.2, 4.2.0-4.3.0 | |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552647 CM-31086 | When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. | 3.7.10-3.7.13, 4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547912 CM-28511 | The following vulnerabilities were discovered in cURL, an URL transfer library. CVE-2019-5436: A heap buffer overflow in the TFTP receiving code was discovered, which could allow DoS or arbitrary code execution. CVE-2019-5482: Thomas Vegas discovered a heap buffer overflow that could be triggered when a small non-default TFTP blocksize is used. Vulnerable: 7.38.0-4+deb8u15 Fixed: 7.38.0-4+deb8u16 | 3.7.10 | 3.7.11-3.7.14.2 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 | 3.7.13-3.7.14.2 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547509 CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547402 CM-28224 | The following security vulnerability has been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Vulnerable: <= 2.1+dfsg-12+deb8u11 Fixed: 2.1+dfsg-12+deb8u12 | 3.7.10 | 3.7.11-3.7.14.2 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547122 CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2547118 CM-28074 | The following security vulnerabilities have been announced in the libtiff5 library on Cumulus Linux 4.0: CVE-2019-14973, CVE-2019-17546: Multiple integer overflows have been discovered in the libtiff library and the included tools. Vulnerable: 4.0.10-4 Fixed: 4.1.0+git191117-2~deb10u1 | 3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2546564 CM-27804 | You might see a switchd memory leak during ECMP group expansion or consolidation. | 3.7.10-3.7.11 | 3.7.12-3.7.14.2 |
| 2546502 CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2546329 CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546267 CM-27646 | Several vulnerabilities have been discovered in Git, a fast, scalable, distributed revision control system, which is available in the Cumulus Linux 3.x repositories for optional installation. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.1.4-2.1+deb8u7 Fixed: 2.1.4-2.1+deb8u8 | 3.7.10-3.7.12 | 3.7.13-3.7.14.2 |
| 2546265 CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546228 CM-27628 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.26-1+debu8u7 Fixed: 3.26-1+debu8u9 | 3.7.10 | 3.7.11-3.7.14.2 |
| 2546010 CM-27530 | When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. | 3.7.10-3.7.14.2 | |
| 2545997 CM-27522 | The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. | 3.7.10-3.7.14.2 | |
| 2545972 CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2545868 CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545866 CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545837 CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. | 3.7.10-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 | 3.7.14-3.7.14.2, 4.1.0-4.3.0 |
| 2545694 CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.1.0-4.3.0 |
| 2545644 CM-27321 | The following CVEs were announced that affect the ghostscript package: CVE-2019-14869: Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. Cumulus Linux 3: <= 9.26a~dfsg-0+deb8u5 vulnerable, >= 9.26a~dfsg-0+deb8u6 fixed. https://security-tracker.debian.org/tracker/ghostscript https://security-tracker.debian.org/tracker/CVE-2019-14869 | 3.7.10 | 3.7.11-3.7.14.2 |
| 2545608 CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2545520 CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2545505 CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2545448 CM-27193 | The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. | 3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545446 CM-27192 | If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. | 3.7.10-3.7.14.2 | |
| 2545405 CM-27174 | The ospfd daemon might crash with the following kernel trace:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 | 3.7.14, 4.1.0-4.3.0 |
| 2545316 CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12-3.7.14.2 |
| 2545236 CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545133 CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2545087 CM-26996 | On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. | 3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545049 CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545027 CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544937 CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544867 CM-26849 | Package: tcpdump CVE ID: CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code. For the detailed security status of tcpdump, refer to its security tracker page at: https://security-tracker.debian.org/tracker/tcpdump Fixed versions: 4.9.3-1~deb10u1 on Cumulus Linux 4, 4.9.3-1~deb8u1 on Cumulus Linux 3. | 3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544847 CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544829 CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544815 CM-26815 | If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2544625 CM-26703 | VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544609 CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544559 CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544401 CM-26566 | Package: openssl CVE ID: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563 Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default. Fixed version: 1.1.1d-0+deb10u1 We recommend that you upgrade your openssl packages. For the detailed security status of openssl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544385 CM-26556 | The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.14.2 |
| 2544324 CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544235 CM-26463 | The following CVEs affect the linux kernel package: CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.10-3.7.14.2 | |
| 2544213 CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544200 CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544182 CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544057 CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2544012 CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543875 CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543840 CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2543835 CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.14.2 |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543727 CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543708 CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543690 CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.14, 4.2.0-4.3.0 |
| 2543665 CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543560 CM-26082 | The following vulnerabilities are only applicable if qemu is installed from the repo mirror. It is not present in the base image by default, so base images without qemu installed are not vulnerable. CVE-2018-20815 CVE-2019-13164 CVE-2019-14378: Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs. Cumulus Linux 3: >= 2.1+dfsg-12+deb8u12 fixed. https://security-tracker.debian.org/tracker/qemu https://security-tracker.debian.org/tracker/CVE-2018-20815 https://security-tracker.debian.org/tracker/CVE-2019-13164 https://security-tracker.debian.org/tracker/CVE-2019-14378 | 3.7.10 | 3.7.11-3.7.14.2 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543374 CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543325 CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543113 CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542958 CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542913 CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542872 CM-25693 | After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542835 CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2542765 CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2542510 CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542384 CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2542248 CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537536 CM-23016 | When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536639 CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2536617 CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:
| 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536559 CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2 |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536231 CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535209 CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.7.5-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2534450 CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2528990 CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
Fixed Issues in 3.7.10
| Issue ID | Description | Affects |
|---|---|---|
| 2544073 CM-26383 | After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 |
3.7.9 Release Notes
Open issues in 3.7.9
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 | 3.7.13-3.7.14.2 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547573 CM-28322 | On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. | 3.7.9-4.0.1 | 4.1.0-4.3.0 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547068 CM-28046 | Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix might be available, or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUXFor example, if /etc/default/grub file contains the following line:GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”change it toGRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo Disable cstates in realtime on the current system which will not persist through a reboot:1. Confirm that the libpci3 package is installedRun dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by executing the command ./cpupower idle-set -d 2C-states have been disabled by default as of Cumulus Linux 4.3.0 | 3.7.9-4.2.1 | 4.3.0 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546502 CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2545868 CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545866 CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545694 CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.1.0-4.3.0 |
| 2545608 CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2545505 CM-27233 | If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2545405 CM-27174 | The ospfd daemon might crash with the following kernel trace:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2545316 CM-27120 | When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. | 3.7.9-3.7.11 | 3.7.12-3.7.14.2 |
| 2545236 CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545133 CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545049 CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545027 CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544937 CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544847 CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544829 CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2544625 CM-26703 | VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544609 CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544559 CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544401 CM-26566 | Package: openssl CVE ID: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563 Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default. Fixed version: 1.1.1d-0+deb10u1 We recommend that you upgrade your openssl packages. For the detailed security status of openssl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544385 CM-26556 | The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.14.2 |
| 2544324 CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544213 CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544200 CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544182 CM-26437 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544073 CM-26383 | After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 | 3.7.10-3.7.14.2 |
| 2544057 CM-26372 | FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2 |
| 2544012 CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543875 CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543840 CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2543835 CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.14.2 |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543727 CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543708 CM-26169 | Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. | 3.7.9-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543690 CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.14, 4.2.0-4.3.0 |
| 2543665 CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543374 CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543325 CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543113 CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542958 CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542913 CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542872 CM-25693 | After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542835 CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2542765 CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2542510 CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542384 CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2542248 CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. | 3.7.0-3.7.14.2 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 | 4.1.0-4.3.0 |
| 2537820 CM-23123 | When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2537536 CM-23016 | When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. | 3.7.5-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2537514 CM-23004 | The local fallback account authenticates using the local password when the RADIUS or TACACS service is up. The expected behavior is for this to fail and only succeed when the RADIUS OR TACACS server fails to respond. | 3.7.1-3.7.14.2 | |
| 2537378 CM-22937 | NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation.To work around this issue, stop snmpd, remove the cache file, then restart snmpd. | 3.7.1-3.7.14.2 | |
| 2537188 CM-22849 | When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur.This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. | 3.7.2-3.7.14.2 | |
| 2537104 CM-22808 | When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. | 3.7.1-3.7.14 | 4.0.0-4.3.0 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 | 4.1.0-4.3.0 |
| 2536639 CM-22605 | On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2536617 CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:
| 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2536608 CM-22583 | Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. | 3.7.0-3.7.14.2 | |
| 2536559 CM-22538 | When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2 |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536231 CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535209 CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.7.5-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2534450 CM-20534 | The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2534394 CM-20480 | The python-crypto package, which is not installed by default on Cumulus Linux, but is present in the repository to be installed, has the following security vulnerability in the version available for Cumulus Linux 3.x: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation. More information at https://security-tracker.debian.org/tracker/CVE-2018-6594 . | 3.7.9-3.7.14.2 | |
| 2528990 CM-15278 | During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
Fixed Issues in 3.7.9
| Issue ID | Description | Affects |
|---|---|---|
| 2548191 CM-28712 | A security scanner may detect a version of wpa or hostapd that is not listed as having been fixed for CVE-2019-13377 and/or CVE-2019-16275. Cumulus Linux since 3.7.9 and 4.0.0 has a customized version of wpa and hostapd which includes the fixes for these vulnerabilities. | 3.7.8 |
| 2545688 CM-27349 | Debian security advisory DSA-4213 for qemu lists a number of security vulnerabilities. https://www.debian.org/security/2018/dsa-4213 The latest upstream version 2.1+dfsg-12+deb8u12 fixes the following vulnerabilities listed in that announcement: CVE-2017-15038 Tuomas Tynkkynen discovered an information leak in 9pfs. CVE-2017-15119 Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service. CVE-2017-15268 A memory leak in websockets support may result in denial of service. CVE-2017-15289 Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service. CVE-2017-16845 Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration. CVE-2017-17381 Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service. CVE-2017-18043 Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service. CVE-2018-5683 Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service. CVE-2018-7550 Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code. The following remains vulnerable in 2.1+dfsg-12+deb8u12: CVE-2017-15124 Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service. Note: qemu is not installed by default, but is available in the repository for optional installation. | |
| 2543546 CM-26073 | {watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. | 3.7.7-3.7.8 |
| 2543469 CM-26022 | When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 |
| 2543389 CM-25979 | Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 |
| 2543329 CM-25956 | The following CVEs were announced in Debian Security Advisory DSA-4499-1 and affect the ghostscript package. ————————————————————————————— Debian Security Advisory DSA-4499-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 12, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: ghostscript CVE ID: CVE-2019-10216 Debian Bug: 934638 Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For the oldstable distribution (stretch), this problem has been fixed in version 9.26a~dfsg-0+deb9u4. For the stable distribution (buster), this problem has been fixed in version 9.27~dfsg-2+deb10u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | |
| 2543311 CM-25944 | The following CVEs were announced in Debian Security Advisory DSA-4495 and DSA 4497 and affect the linux kernel package. ——————————————————————————————— Debian Security Advisory DSA-4495-1 security@debian.org https://www.debian.org/security/ Ben Hutchings August 10, 2019 https://www.debian.org/security/faq ——————————————————————————————— Package: linux CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, the guest is able to access its memory and I/O regions before enabling decoding of those regions. This could result in a denial-of-service (unexpected NMI) on the host. The fix for this is incompatible with qemu versions before 2.5. (CVE ID not yet assigned) Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAP_NET_ADMIN capability (in any user namespace) could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. CVE-2018-5995 ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities. CVE-2018-20836 chenxiang reported a race condition in libsas, the kernel subsystem supporting Serial Attached SCSI (SAS) devices, which could lead to a use-after-free. It is not clear how this might be exploited. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-1999 A race condition was discovered in the Android binder driver, which could lead to a use-after-free. If this driver is loaded, a local user might be able to use this for denial-of-service (memory corruption) or for privilege escalation. CVE-2019-1125 It was discovered that most x86 processors could speculatively skip a conditional SWAPGS instruction used when entering the kernel from user mode, and/or could speculatively execute it when it should be skipped. This is a subtype of Spectre variant 1, which could allow local users to obtain sensitive information from the kernel or other processes. It has been mitigated by using memory barriers to limit speculative execution. Systems using an i386 kernel are not affected as the kernel does not use SWAPGS. CVE-2019-3882 It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition). CVE-2019-3900 It was discovered that vhost drivers did not properly control the amount of work done to service requests from guest VMs. A malicious guest could use this to cause a denial-of-service (unbounded CPU usage) on the host. CVE-2019-10207 The syzkaller tool found a potential null dereference in various drivers for UART-attached Bluetooth adapters. A local user with access to a pty device or other suitable tty device could use this for denial-of-service (BU G/oops). CVE-2019-10638 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function, “jhash”. This could enable tracking individual computers as they communicate with different remote servers and from different networks. The “siphash” function is now used instead. CVE-2019-10639 Amit Klein and Benny Pinkas discovered that the generation of IP packet IDs used a weak hash function that incorporated a kernel virtual address. This hash function is no longer used for IP IDs, although it is still used for other purposes in the network stack. CVE-2019-12817 It was discovered that on the PowerPC (ppc64el) architecture, the hash page table (HPT) code did not correctly handle fork() in a process with memory mapped at addresses above 512 TiB. This could lead to a use-after-free in the kernel, or unintended sharing of memory between user processes. A local user could use this for privilege escalation. Systems using the radix MMU, or a custom kernel with a 4 KiB page size, are not affected. CVE-2019-12984 It was discovered that the NFC protocol implementation did not properly validate a netlink control message, potentially leading to a null pointer dereference. A local user on a system with an NFC interface could use this for denial-of-service (BUG/oops). CVE-2019-13233 Jann Horn discovered a race condition on the x86 architecture, in use of the LDT. This could lead to a use-after-free. A local user could possibly use this for denial-of-service. CVE-2019-13631 It was discovered that the gtco driver for USB input tablets could overrun a stack buffer with constant data while parsing the device’s descriptor. A physically present user with a specially constructed USB device could use this to cause a denial-of-service (BUG/oops), or possibly for privilege escalation. CVE-2019-13648 Praveen Pandey reported that on PowerPC (ppc64el) systems without Transactional Memory (TM), the kernel would still attempt to restore TM state passed to the sigreturn() system call. A local user could use this for denial-of-service (oops). CVE-2019-14283 The syzkaller tool found a missing bounds check in the floppy disk driver. A local user with access to a floppy disk device, with a disk present, could use this to read kernel memory beyond the I/O buffer, possibly obtaining sensitive information. CVE-2019-14284 The syzkaller tool found a potential division-by-zero in the floppy disk driver. A local user with access to a floppy disk device could use this for denial-of-service (oops). (CVE ID not yet assigned) Denis Andzakovic reported a possible use-after-free in the TCP sockets implementation. A local user could use this for denial-of-service (memory corruption or crash) or possibly for privilege escalation. (CVE ID not yet assigned) The netfilter conntrack subsystem used kernel addresses as user-visible IDs, which could make it easier to exploit other security vulnerabilities. XSA-300 Julien Grall reported that Linux does not limit the amount of memory which a domain will attempt to baloon out, nor limits the amount of “foreign / grant map” memory which any individual guest can consume, leading to denial of service conditions (for host or guests). For the oldstable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u5. For the stable distribution (buster), these problems have been fixed in version 4.19.37-5+deb10u2. For the oldstable distribution (stretch), these problems will be fixed soon. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | |
| 2543008 CM-25784 | The following CVEs were announced in Debian Security Advisory DSA-4489-1. ————————————————————————————— Debian Security Advisory DSA-4489-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: patch CVE ID: CVE-2019-13636 CVE-2019-13638 Debian Bug: 932401 933140 Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed. This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140). For the oldstable distribution (stretch), these problems have been fixed in version 2.7.5-1+deb9u2. For the stable distribution (buster), these problems have been fixed in version 2.7.6-3+deb10u1. We recommend that you upgrade your patch packages. For the detailed security status of patch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/patch | |
| 2543004 CM-25783 | Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails.To work around this issue, perform your own checksum validation before staging a new image with onie-install. | 3.7.7-3.7.8 |
| 2542985 CM-25770 | On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 |
| 2542966 CM-25754 | A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | |
| 2542939 CM-25735 | When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. | 3.7.8 |
| 2542853 CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 |
| 2542837 CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.3.0 |
| 2542820 CM-25664 | On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 |
| 2542774 CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 |
| 2542726 CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.7.5-3.7.8 |
| 2542711 CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 |
| 2542480 CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 |
| 2542472 CM-25488 | On Broadcom-based VXLAN routing capable platforms, VXLAN traffic received at the egress VTEP might drop because the hardware is mis-programming. This issue is related to timing and is not easily reproduced. This issue might occur after a VXLAN interface (VNI) state transition (the peerlink goes down and puts VNI into a protodown state, then the peerlink comes back and the VNI returns to UP) and is related to how the next-hop information is programmed in hardware. Sometimes the host routes corresponding to this VXLAN segment are mis-programmed with the wrong next hop information. To work around this issue, restart the switchd service with the sudo systemctl restart switchd.service command. | |
| 2542423 CM-25467 | The following CVEs were announced in Debian Security Advisory DSA-4472-1 and affect the expat (libexpat1) package. ————————————————————————————- Debian Security Advisory DSA-4472-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2019 https://www.debian.org/security/faq ————————————————————————————- Package: expat CVE ID: CVE-2018-20843 Debian Bug: 931031 It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service. For the stable distribution (stretch), this problem has been fixed in version 2.2.0-2+deb9u2. We recommend that you upgrade your expat packages. For the detailed security status of expat, refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat | |
| 2542365 CM-25432 | The snmpd service frequently crashes due to double free or corruption. | 3.7.6-3.7.8 |
| 2542341 CM-25417 | The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.8 |
| 2542336 CM-25414 | On the Mellanox SN2410 switch, switchd does not start. | 3.7.2-3.7.8 |
| 2542297 CM-25395 | When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. | 3.7.6-3.7.8 |
| 2542193 CM-25358 | When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down.To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
| 3.7.6-3.7.8 |
| 2542160 CM-25343 | The following CVEs were announced in Debian Security Advisory DSA-4465-1 and affect the linux kernel. ——————————————————————————————- Debian Security Advisory DSA-4465-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 17, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: linux CVE ID: CVE-2019-3846 CVE-2019-5489 CVE-2019-9500 CVE-2019-9503 CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11599 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 Debian Bug: 928989 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-3846, CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of arbitrary code. CVE-2019-5489 Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh discovered that local users could use the mincore() system call to obtain sensitive information from other processes that access the same memory-mapped file. CVE-2019-9500, CVE-2019-9503 Hugues Anguelkov discovered a buffer overflow and missing access validation in the Broadcom FullMAC wifi driver (brcmfmac), which a attacker on the same wifi network could use to cause denial of service or the execution of arbitrary code. CVE-2019-11477 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) allows a remotely triggerable kernel panic. CVE-2019-11478 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) will fragment the TCP retransmission queue, allowing an attacker to cause excessive resource usage. CVE-2019-11479 Jonathan Looney reported that an attacker could force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data, drastically increasing the bandwidth required to deliver the same amount of data. This update introduces a new sysctl value to control the minimal MSS (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard-coded value of 48. We recommend raising this to 536 unless you know that your network requires a lower value. CVE-2019-11486 Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled. CVE-2019-11599 Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation. CVE-2019-11815 It was discovered that a use-after-free in the Reliable Datagram Sockets protocol could result in denial of service and potentially privilege escalation. This protocol module (rds) is not auto-loaded on Debian systems, so this issue only affects systems where it is explicitly loaded. CVE-2019-11833 It was discovered that the ext4 filesystem implementation writes uninitialised data from kernel memory to new extent blocks. A local user able to write to an ext4 filesystem and then read the filesystem image, for example using a removable drive, might be able to use this to obtain sensitive information. CVE-2019-11884 It was discovered that the Bluetooth HIDP implementation did not ensure that new connection names were null-terminated. A local user with CAP_NET_ADMIN capability might be able to use this to obtain sensitive information from the kernel stack. For the stable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u3. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.6-3.7.8 |
| 2542058 CM-25295 | The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. | 3.7.6-3.7.8 |
| 2542032 CM-25284 | If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. | 3.7.6-3.7.8 |
| 2541924 CM-25240 | If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. | 3.7.6-3.7.8 |
| 2541604 CM-25079 | The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem.To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
| 3.7.2-3.7.8 |
| 2541346 CM-24963 | The following CVEs were announced in Debian Security Advisory DSA-4440-1. ————————————————————————————— Debian Security Advisory DSA-4440-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 09, 2019 https://www.debian.org/security/faq ————————————————————————————— Package: bind9 CVE ID: CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Multiple vulnerabilities were found in the BIND DNS server: CVE-2018-5743 Connection limits were incorrectly enforced. CVE-2018-5745 The “managed-keys” feature was susceptible to denial of service by triggering an assert. CVE-2019-6465 ACLs for zone transfers were incorrectly enforced for dynamically loadable zones (DLZs). For the stable distribution (stretch), these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u5. We recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9 | |
| 2541005 CM-24784 | NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:
| 3.7.7-3.7.8 |
| 2540685 CM-24593 | On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. | 3.7.3-3.7.8 |
| 2540601 CM-24544 | If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. | 3.7.3-3.7.8 |
| 2540359 CM-24440 | bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. | 3.7.6-3.7.8 |
| 2538741 CM-23652 | The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. | 3.7.2-3.7.8 |
| 2538710 CM-23636 | The following CVEs were announced in Debian Security Advisory DSA-4436-1 and affect the imagemagick packages. ——————————————————————————————- Debian Security Advisory DSA-4371-1 security@debian.org https://www.debian.org/security/ Yves-Alexis Perez January 22, 2019 https://www.debian.org/security/faq ——————————————————————————————- Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine. Since the vulnerability is present in the package manager itself, it is recommended to disable redirects in order to prevent exploitation during this upgrade only, using: apt -o Acquire::http::AllowRedirect=false update apt -o Acquire::http::AllowRedirect=false upgrade This is known to break some proxies when used against security.debian.org. If that happens, people can switch their security APT source to use deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main For the stable distribution (stretch), this problem has been fixed in version 1.4.9. | |
| 2538480 CM-23523 | Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. | 3.7.2-3.7.8 |
| 2538321 CM-23431 | On the Trident3 switch, the input chain ACLs drop action forwards packets if the traffic is destined to the CPU on an SVI. | |
| 2538257 CM-23398 | The following CVEs were announced in Debian Security Advisory DSA-4359-1 and affect the wireshark packages, some of which are available for optional installation on Cumulus Linux: CVE ID: CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 All CVEs except for CVE-2018-12086 are fixed in Cumulus Linux 3.7.9. Packages: libwireshark5, libwireshark-data, libwiretap8, libwscodecs2, libwsutil9, tshark, wireshark, wireshark-common, wireshark-doc These problems have been fixed in version 1.12.1+g01b65bf-4+deb8u19 We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark, refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark | 3.7.8 |
| 2538022 CM-23285 | When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. | 3.7.2-3.7.8 |
| 2537799 CM-23114 | The following CVEs were announced in Debian Security Advisory DSA-4347-1. ————————————————————————————————– Debian Security Advisory DSA-4347-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 29, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: perl CVE ID: CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314 Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-basedbuffer overflow with attacker-controlled input. CVE-2018-18312 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow write during compilation, potentially allowing arbitrary code execution. CVE-2018-18313 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow read during compilation which leads to information leak. CVE-2018-18314 Jakub Wilk discovered that a specially crafted regular expression could lead to a heap-based buffer overflow. For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u5. We recommend that you upgrade your perl packages. For the detailed security status of perl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl | |
| 2537753 CM-23096 | The following CVEs were announced in Debian Security Advisory DSA-4372-1. ————————————————————————————————– Debian Security Advisory DSA-4346-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 27, 2018 https://www.debian.org/security/faq ————————————————————————————————– Package: ghostscript CVE ID: CVE-2018-19409 CVE-2018-19475 CVE-2018-19476 CVE-2018-19477 Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled). This update rebases ghostscript for stretch to the upstream version 9.26 which includes additional changes. For the stable distribution (stretch), these problems have been fixed in version 9.26~dfsg-0+deb9u1. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | |
| 2537153 CM-22834 | In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. | 3.7.2-3.7.8 |
| 2536651 CM-22608 | Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. | 3.7.0-3.7.8 |
| 2536154 CM-22203 | By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests. | |
| 2535445 CM-21511 | If a VNI is configured before the bridge in /etc/network/interfaces, the switch does not send IGMP queries.To work around this issue, edit the /etc/network/interfaces file to define the bridge before the VNI. For example:
. | |
| 2534887 CM-20966 | The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected). | |
| 2534730 CM-20809 | The following CVEs were announced in a Debian Security Advisory. ————————————————————————————————– It was discovered that Ghostscript incorrectly handled certain PostScript files. An attacker could possibly use this to cause a denial of server. (CVE-2016-10317) It was discovered that Ghostscript incorrectly handled certain PDF files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10194) Debian CVE links: https://security-tracker.debian.org/tracker/CVE-2016-10317 and https://security-tracker.debian.org/tracker/CVE-2018-10194 | |
| 2533865 CM-19960 | The following CVEs were announced in Debian Security Advisory DSA-4131. ——————————————————————————————- Debian Security Advisory DSA-4131-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 04, 2018 https://www.debian.org/security/faq —————————————————————————————— Package: xen CVE ID: CVE-2018-7540 CVE-2018-7541 CVE-2018-7542 Multiple vulnerabilities have been discovered in the Xen hypervisor: CVE-2018-7540 Jann Horn discovered that missing checks in page table freeing may result in denial of service. CVE-2018-7541 Jan Beulich discovered that incorrect error handling in grant table checks may result in guest-to-host denial of service and potentially privilege escalation. CVE-2018-7542 Ian Jackson discovered that insufficient handling of x86 PVH guests without local APICs may result in guest-to-host denial of service. For the stable distribution (stretch), these problems have been fixed in version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen | |
| 2532396 CM-18537 | Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics. |
3.7.8 Release Notes
Open issues in 3.7.8
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2617009 | CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code Vulnerable: 1.7.0~dfsg-1Fixed: 1.7.0~dfsg-1+deb8u1 | 3.7.0-3.7.14.2 | |
| 2617008 | CVE-2021-28831: The gunzip decompressor of Busybox, tiny utilities for small and embedded systems, mishandled the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data Vulnerable: <= 1.22.0-9+deb8u4Fixed: 1.22.0-9+deb8u5 | 3.7.0-3.7.14.2 | |
| 2617007 | CVE-2021-3443 CVE-2021-3467: Two issues have been found in jasper, a JPEG-2000 runtime library. Both issues are related to jpeg 2000 decoding, where a null pointer dereference and a missing check of valid component numbers referenced by CDEF box, could be exploited Vulnerable: <= 1.900.1-debian1-2.4+deb8u9Fixed: 1.900.1-debian1-2.4+deb8u10 | 3.7.0-3.7.14.2 | |
| 2617006 | CVE-2021-28957: An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute Vulnerable: <= 3.4.0-1+deb8u3Fixed: 3.4.0-1+deb8u4 | 3.7.0-3.7.14.2 | |
| 2617002 | CVE-2020-25666 CVE-2020-25675 CVE-2020-25676 CVE-2020-27754 CVE-2020-27757 CVE-2020-27758 CVE-2020-27759 CVE-2020-27761 CVE-2020-27762 CVE-2020-27764 CVE-2020-27766 CVE-2020-27767 CVE-2020-27768 CVE-2020-27769 CVE-2020-27770 CVE-2020-27771 CVE-2020-27772 CVE-2020-27774 CVE-2020-27775 CVE-2021-20176 CVE-2021-20241 CVE-2021-20244 CVE-2021-20246: Multiple security vulnerabilities were fixed in Imagemagick. Missing or incomplete input sanitising may lead to undefined behavior which can result in denial of service (application crash) or other unspecified impact Vulnerable: 6.8.9.9-5+deb8u22Fixed: 6.8.9.9-5+deb8u23 | 3.7.0-3.7.14.2 | |
| 2589570 | The following denial-of-service vulnerability has been announced in Pygments, a syntax highlighting library for Python:CVE-2021-27291: A number of regular expressions had exponential or cubic worst-case complexity which could cause a remote denial of service (DoS) when provided with malicious input Vulnerable: <= 2.0.1+dfsg-1.1+deb8u2Fixed: 2.0.1+dfsg-1.1+deb8u3 | 3.7.0-3.7.14.2 | |
| 2589567 | The following vulnerabilities have been announced in Pillow, a Python imaging library, which can be used to cause a denial-of-service attack with crafted image files:CVE-2020-35653: PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size Vulnerable: <= 2.6.1-2+deb8u5FIxed: 2.6.1-2+deb8u6 | 3.7.0-3.7.14.2 | |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2552739 CM-31148 | Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.14.2 | |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552352 CM-30914 | The following security vulnerabilities have been announced in the nss / libnss3 packages: CVE-2020-6829: Side channel attack on ECDSA signature generation CVE-2020-12400: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12401: ECDSA timing attack mitigation bypass Vulnerable: <= 3.26-1+debu8u11 Fixed: 3.26-1+debu8u12 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2552351 CM-30913 | The following vulnerability has been announced in the libx11 packages: CVE-2020-14344: The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method. Vulnerable: <= 1.6.2-3+deb8u2 Fixed: 1.6.2-3+deb8u3 | 3.7.0-3.7.13 | 3.7.14-3.7.14.2 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551288 CM-30286 | When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550323 CM-29807 | After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. | 3.7.3-3.7.12 | 3.7.13-3.7.14.2, 4.0.0-4.3.0 |
| 2548475 CM-28932 | After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. | 3.7.6-3.7.13 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548191 CM-28712 | A security scanner may detect a version of wpa or hostapd that is not listed as having been fixed for CVE-2019-13377 and/or CVE-2019-16275. Cumulus Linux since 3.7.9 and 4.0.0 has a customized version of wpa and hostapd which includes the fixes for these vulnerabilities. | 3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2547769 CM-28437 | syslog might report a high load average with the CPU running a later microcode revision. | 3.7.4-3.7.12 | 3.7.13-3.7.14.2 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.14.2, 4.1.0-4.3.0 |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2546385 CM-27698 | SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.14.2 | |
| 2545694 CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.1.0-4.3.0 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2545405 CM-27174 | The ospfd daemon might crash with the following kernel trace:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2545236 CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545133 CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2545027 CM-26954 | In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544937 CM-26894 | The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2544847 CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544829 CM-26829 | Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2544609 CM-26691 | BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544559 CM-26657 | When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544401 CM-26566 | Package: openssl CVE ID: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563 Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default. Fixed version: 1.1.1d-0+deb10u1 We recommend that you upgrade your openssl packages. For the detailed security status of openssl, refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544385 CM-26556 | The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.14.2 |
| 2544324 CM-26523 | Package: hostapd CVE ID: CVE-2019-13377 CVE-2019-16275 Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point). CVE-2019-13377 A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password. CVE-2019-16275 Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network. Fixed version: 1:2.8.0-cl4u3 | 3.7.0-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544213 CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544012 CM-26351 | After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.14.2 |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543875 CM-26272 | On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543840 CM-26255 | On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2543835 CM-26252 | The following CVEs were announced that affect the ghostscript package: CVE ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. We recommend that you upgrade your ghostscript packages. For the detailed security status of ghostscript, refer to its security tracker page at: https://security-tracker.debian.org/tracker/ghostscript | 3.7.0-3.7.10 | 3.7.11-3.7.14.2 |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543800 CM-26230 | When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. | 3.7.8-3.7.14 | 4.0.0-4.3.0 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543727 CM-26181 | ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543690 CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.14, 4.2.0-4.3.0 |
| 2543665 CM-26146 | clagd memory consumption increases under certain unknown conditions. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543627 CM-26126 | Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543546 CM-26073 | {watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2543469 CM-26022 | When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 | 3.7.9-3.7.14.2 |
| 2543389 CM-25979 | Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2 |
| 2543374 CM-25973 | After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543325 CM-25955 | Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543113 CM-25824 | NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. | 3.7.3-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543058 CM-25798 | The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.14 | 4.0.0-4.3.0 |
| 2543052 CM-25796 | Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. | 3.7.5-3.7.14 | 4.0.0-4.3.0 |
| 2543044 CM-25794 | Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.14 | 4.0.0-4.3.0 |
| 2543004 CM-25783 | Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails.To work around this issue, perform your own checksum validation before staging a new image with onie-install. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2 |
| 2542985 CM-25770 | On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2 |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542958 CM-25747 | When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542939 CM-25735 | When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. | 3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2542913 CM-25718 | IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542872 CM-25693 | After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542853 CM-25684 | For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel.To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542837 CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.3.0 | 3.7.9-3.7.14 |
| 2542835 CM-25672 | snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. | 3.7.4-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.14, 4.1.0-4.3.0 |
| 2542820 CM-25664 | On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2542774 CM-25646 | When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 | 3.7.13-3.7.14, 4.1.0-4.3.0 |
| 2542765 CM-25640 | When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2 |
| 2542726 CM-25619 | After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. | 3.7.5-3.7.8 | 3.7.9-3.7.14.2 |
| 2542711 CM-25610 | BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542510 CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.14, 4.1.0-4.3.0 |
| 2542480 CM-25489 | When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap.To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542384 CM-25447 | When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. | 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542365 CM-25432 | The snmpd service frequently crashes due to double free or corruption. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542341 CM-25417 | The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. | 3.7.7-3.7.8 | 3.7.9-3.7.14.2 |
| 2542336 CM-25414 | On the Mellanox SN2410 switch, switchd does not start. | 3.7.2-3.7.8 | 3.7.9-3.7.14.2 |
| 2542310 CM-25404 | hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. | 3.7.6-3.7.14.2 | |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2542297 CM-25395 | When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542248 CM-25376 | When you generate a cl-support file, clagd.service prints log messages similar to the following:
| 3.7.6-3.7.10 | 3.7.11-3.7.14.2, 4.0.0-4.3.0 |
| 2542193 CM-25358 | When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down.To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
| 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542160 CM-25343 | The following CVEs were announced in Debian Security Advisory DSA-4465-1 and affect the linux kernel. ——————————————————————————————- Debian Security Advisory DSA-4465-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 17, 2019 https://www.debian.org/security/faq ——————————————————————————————- Package: linux CVE ID: CVE-2019-3846 CVE-2019-5489 CVE-2019-9500 CVE-2019-9503 CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11599 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 Debian Bug: 928989 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-3846, CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of arbitrary code. CVE-2019-5489 Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh discovered that local users could use the mincore() system call to obtain sensitive information from other processes that access the same memory-mapped file. CVE-2019-9500, CVE-2019-9503 Hugues Anguelkov discovered a buffer overflow and missing access validation in the Broadcom FullMAC wifi driver (brcmfmac), which a attacker on the same wifi network could use to cause denial of service or the execution of arbitrary code. CVE-2019-11477 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) allows a remotely triggerable kernel panic. CVE-2019-11478 Jonathan Looney reported that a specially crafted sequence of TCP selective acknowledgements (SACKs) will fragment the TCP retransmission queue, allowing an attacker to cause excessive resource usage. CVE-2019-11479 Jonathan Looney reported that an attacker could force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data, drastically increasing the bandwidth required to deliver the same amount of data. This update introduces a new sysctl value to control the minimal MSS (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard-coded value of 48. We recommend raising this to 536 unless you know that your network requires a lower value. CVE-2019-11486 Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled. CVE-2019-11599 Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation. CVE-2019-11815 It was discovered that a use-after-free in the Reliable Datagram Sockets protocol could result in denial of service and potentially privilege escalation. This protocol module (rds) is not auto-loaded on Debian systems, so this issue only affects systems where it is explicitly loaded. CVE-2019-11833 It was discovered that the ext4 filesystem implementation writes uninitialised data from kernel memory to new extent blocks. A local user able to write to an ext4 filesystem and then read the filesystem image, for example using a removable drive, might be able to use this to obtain sensitive information. CVE-2019-11884 It was discovered that the Bluetooth HIDP implementation did not ensure that new connection names were null-terminated. A local user with CAP_NET_ADMIN capability might be able to use this to obtain sensitive information from the kernel stack. For the stable distribution (stretch), these problems have been fixed in version 4.9.168-1+deb9u3. We recommend that you upgrade your linux packages. For the detailed security status of linux, refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542058 CM-25295 | The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2542032 CM-25284 | If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2541924 CM-25240 | If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2541604 CM-25079 | The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem.To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
| 3.7.2-3.7.8 | 3.7.9-3.7.14.2 |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541165 CM-24878 | On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. | 3.7.6-3.7.14.2 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541005 CM-24784 | NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:
| 3.7.7-3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540885 CM-24703 | The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.14.2 | |
| 2540863 CM-24686 | On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. | 3.7.3-3.7.14 | 4.0.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540685 CM-24593 | On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. | 3.7.3-3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2540601 CM-24544 | If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. | 3.7.3-3.7.8 | 3.7.9-3.7.14.2, 4.0.0-4.3.0 |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540359 CM-24440 | bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. | 3.7.6-3.7.8 | 3.7.9-3.7.14.2 |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539081 CM-23792 | When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. | 3.7.0-3.7.14 | 4.0.0-4.3.0 |
| 2538875 CM-23696 | IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. | 3.7.2-3.7.14.2 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538741 CM-23652 | The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. | 3.7.2-3.7.8 | 3.7.9-3.7.14.2 |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538480 CM-23523 | Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. | 3.7.2-3.7.8 | 3.7.9-3.7.14.2 |
| 2538302 CM-23422 | portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which caus |