Cumulus Linux 4.1 Release Notes
Download all 4.1 release notes as .xls
4.1.1 Release Notes
Open issues in 4.1.1
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-30832 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.2.1 | 3.7.14.2, 4.3.0 |
| CM-28249 | On the Mellanox switch, when you modify the buffer and queue configuration without restarting switchd, you might see a one second interruption in forwarding. | 4.0.0-4.3.0 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2578872 | CVE-2021-20270: It was discovered that Pygments, a syntax highlighting package written in Python, could be forced into an infinite loop, resulting in denial of service Vulnerable: 2.3.1+dfsg-1Fixed: 2.3.1+dfsg-1+deb10u1 | 4.0.0-4.3.0 | |
| 2578870 | CVE-2020-35523 CVE-2020-35524: Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed Vulnerable: <= 4.1.0+git191117-2~deb10u1Fixed: 4.1.0+git191117-2~deb10u2 | 4.0.0-4.3.0 | |
| 2574368 | When you run the NCLU net add bgp maximum-paths ibgp command, FRR restarts unexpectedlyTo work around this issue, either use the vtysh commands or edit the /etc/frr/frr.conf file directly, then run systemctl reload frr. | 4.1.1-4.3.0 | |
| 2566880 | CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2564839 | Several vulnerabilities have been discovered in the GRUB2 bootloader:CVE-2020-14372: It was discovered that the acpi command allows a privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-25632: A use-after-free vulnerability was found in the rmmod command CVE-2020-25647: An out-of-bound write vulnerability was found in the grub_usb_device_initialize() function, which is called to handle USB device initialization CVE-2020-27749: A stack buffer overflow flaw was found in grub_parser_split_cmdline CVE-2020-27779: It was discovered that the cutmem command allows a privileged user to remove memory regions when Secure Boot is enabled CVE-2021-20225: A heap out-of-bounds write vulnerability was found in the short form option parser CVE-2021-20233: A heap out-of-bound write flaw was found caused by mis-calculation of space required for quoting in the menu rendering. | 4.0.0-4.3.0 | |
| 2558184 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2556783 CM-33398 | CVE-2021-0326: An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution. Vulnerable: <= 2.8.0-cl3.7.14u1, <= 2.8.0-cl4.2.1u1 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556778 CM-33395 | CVE-2021-26937: A flaw in the handling of combining characters in screen, a terminal multiplexer with VT100/ANSI terminal emulation can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence. Vulnerable: 4.6.2-3 Fixed: 4.6.2-3+deb10u1 | 4.0.0-4.3.0 | |
| 2556776 CM-33394 | CVE-2021-27212: A vulnerability in the Certificate List Exact Assertion validation was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of this flaw to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u5 Fixed: 2.4.47+dfsg-3+deb10u6 | 4.0.0-4.3.0 | |
| 2556775 CM-33393 | DSA-4859-1 (no CVE): zstd, a compression utility, was vulnerable to a race condition: it temporarily exposed, during a very short timeframe, a world-readable version of its input even if the original file had restrictive permissions. Vulnerable: <= 1.3.8+dfsg-3+deb10u1 Fixed: 1.3.8+dfsg-3+deb10u2 | 4.0.0-4.3.0 | |
| 2556764 CM-33385 | In a configuration with both traditional and vlan-aware bridges, the VLAN membership check on a vlan-aware switch does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556731 CM-33359 | CVE-2020-8625: A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, a DNS server implementation, which could result in denial of service (daemon crash), or potentially the execution of arbitrary code. Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u2 Fixed: 9.11.5.P4+dfsg-5.1+deb10u3 | 4.0.0-4.3.0 | |
| 2556691 CM-33334 | The following vulnerabilities have been announced in the openssl packages: CVE-2021-23840: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. CVE-2019-1551: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Vulnerable: <= 1.1.1d-0+deb10u4 Fixed: 1.1.1d-0+deb10u5 | 4.0.0-4.3.0 | |
| 2556659 CM-33315 | CVE-2020-35498: A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Vulnerable: <= 2.8.90-1-cl4u5 | 4.0.0-4.3.0 | |
| 2556569 CM-33283 | DSA-4850-1 (no CVE): libzstd adds read permissions to files while being compressed or uncompressed. Vulnerable: 1.3.8+dfsg-3 Fixed: 1.3.8+dfsg-3+deb10u1 | 4.0.0-4.3.0 | |
| 2556500 CM-33258 | Cumulus Linux does not support bond members at 200G or greater. | 4.0.0-4.3.0 | |
| 2556456 CM-33237 | CVE-2020-36221, CVE-2020-36222, CVE-2020-36223, CVE-2020-36224, CVE-2020-36225, CVE-2020-36226, CVE-2020-36227, CVE-2020-36228, CVE-2020-36229, CVE-2020-36230: Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u4 Fixed: 2.4.47+dfsg-3+deb10u5 | 4.0.0-4.3.0 | |
| 2556279 CM-33160 | CVE-2021-3156: A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug. Vulnerable: <= 1.8.27-1+deb10u2 Fixed: 1.8.27-1+deb10u3 | 4.0.0-4.2.1 | 4.3.0 |
| 2556218 CM-33117 | The following vulnerability affects lldpd: CVE-2020-27827: A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Fixed: 1.0.4-0-cl4.3.0u2 | 3.7.14-4.2.1 | 4.3.0 |
| 2556081 CM-33049 | You cannot set the time zone can with NCLU commands. | 4.1.1-4.3.0 | |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2556012 CM-32994 | On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. | 3.7.14, 4.0.0-4.2.1 | 3.7.14.2, 4.3.0 |
| 2555761 CM-32860 | The following vulnerabilities were announced in the p11-kit (libp11-kit0) packages: CVE-2020-29361: Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. CVE-2020-29362: A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation. CVE-2020-29363: A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value. Vulnerable: 0.23.15-2 Fixed: 0.23.15-2_deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2555691 CM-32829 | The NET-SNMP-EXTEND-MIB, disabled in Cumulus Linux 4.2.1 and 3.7.14 to prevent security vulnerability CVE-2020-15862, is re-enabled read-only. | 3.7.14-4.2.1 | 4.3.0 |
| 2555528 CM-32750 | In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. | 3.7.14-4.2.1 | 4.3.0 |
| 2555506 CM-32733 | CVE-2020-29479 CVE-2020-29480 CVE-2020-29481 CVE-2020-29482 CVE-2020-29483 CVE-2020-29484 CVE-2020-29485 CVE-2020-29486 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Several security issues affecting Xenstore could result in cross domain access (denial of service, information leaks or privilege escalation) or denial of service against xenstored. Additional vulnerabilities could result in guest-to-host denial of service. Vulnerable: <= 4.11.4+57-g41a822c392-1 Fixed: 4.11.4+57-g41a822c392-2 | 4.0.0-4.2.1 | 4.3.0 |
| 2555428 CM-32683 | When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. | 3.7.13-4.2.1 | 4.3.0 |
| 2555401 CM-32661 | On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0 |
| 2555373 CM-32641 | CVE-2020-27350: Missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. CVE-2020-27351: Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service. Vulnerable: apt <= 1.8.2.1, python-apt <= 1.8.4.1 Fixed: apt 1.8.2.2, python-apt 1.8.4.3 | 4.0.0-4.2.1 | 4.3.0 |
| 2555339 CM-32622 | The following vulnerability has been announced in OpenSSL: CVE-2020-1971: A flaw in the GENERAL_NAME_cmp() function could cause a NULL dereference when both GENERAL_NAMEs contain an EDIPARTYNAME, resulting in denial of service. More information can be found at https://www.openssl.org/news/secadv/20201208.txt . Vulnerable: <= 1.1.1d-0+deb10u3 Fixed: 1.1.1d-0+deb10u4 | 4.0.0-4.2.1 | 4.3.0 |
| 2555270 CM-32592 | CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27674 CVE-2020-28368: Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or information leaks. Vulnerable: < 4.11.4+57-g41a822c392-1 Fixed: 4.11.4+57-g41a822c392-1 | 4.0.0-4.2.1 | 4.3.0 |
| 2555183 CM-32532 | CVE-2020-8927: A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a “one-shot” decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. If one cannot update to a fixed version, we recommend to use the “streaming” API as opposed to the “one-shot” API, and impose chunk size limits. Vulnerable: 1.0.7-2 Fixed: 1.0.7-2+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554992 CM-32420 | When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. | 3.7.13-4.2.1 | 4.3.0 |
| 2554982 CM-32412 | CVE-2020-28196: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. Vulnerable: 1.17-3 Fixed: 1.17-3+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554834 CM-32311 | CVE-2020-25709, CVE-2020-25710: Two vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u3 Fixed: 2.4.47+dfsg-3+deb10u4 | 4.0.0-4.2.1 | 4.3.0 |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554707 CM-32215 | On the Dell S5048F-ON switch, optical transceivers do not come up and the modules are in reset mode. | 4.0.0-4.2.1 | 4.3.0 |
| 2554617 CM-32169 | OpenSSH is vulnerable to CVE-2020-14145, as described in https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf. This is an information leak in algorithm negotiation that can allow man-in-the-middle attacks on initial connection attempts without a previously stored server host key on the client. If desired, mitigation using UpdateHostKeys and HostKeyAlgorithms is also given in that paper. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2554588 CM-32149 | If you try reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running.To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
to:
| 3.7.13-4.2.1 | 4.3.0 |
| 2554533 CM-32112 | On the ARM platform, NTP peer associations slowly increase to larger offsets (~500ms). | 4.0.0-4.3.0 | |
| 2554531 CM-32110 | CVE-2020-25692: A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet. The slapd package is not present in the image or repository, although the OpenLDAP libraries are present. Vulnerable: <= 2.4.47+dfsg-3+deb10u2 Fixed: 2.4.47+dfsg-3+deb10u3 | 4.0.0-4.2.1 | 4.3.0 |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554307 CM-31968 | The following vulnerability has been announced in freetype: CVE-2020-15999: Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. Vulnerable: <= 2.9.1-3+deb10u1 Fixed: 2.9.1-3+deb10u2 | 4.0.0-4.2.1 | 4.3.0 |
| 2554282 CM-31954 | A security issue was discovered in the MariaDB database server. Vulnerable: 10.3.25-0 Fixed: 10.3.25-0+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554246 CM-31936 | When you back up and restore a configuration using the conf-backup utility, the switch might hang when rebooted. | 4.1.1-4.2.1 | 4.3.0 |
| 2554131 CM-31864 | CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Vulnerable: 0.14.0-1.3 Fixed: 0.14.0-1.3+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553878 CM-31697 | Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. These include the following:CVE-2020-25595, CVE-2020-25596, CVE-2020-25597, CVE-2020-25599, CVE-2020-25600, CVE-2020-25601, CVE-2020-25602, CVE-2020-25603, CVE-2020-25604. Vulnerable: < 4.11.4+37-g3263f257ca-1 Fixed: 4.11.4+37-g3263f257ca-1 | 4.0.0-4.2.1 | 4.3.0 |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553732 CM-31618 | A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553677 CM-31605 | When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. | 3.7.13-3.7.14.2, 4.0.0-4.3.0 | |
| 2553588 CM-31565 | Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553568 CM-31560 | After a MAC address moves from one remote VTEP to another, the MAC address continues to point to the old VTEP IP address in hardware. | 4.1.1-4.2.1 | 4.3.0 |
| 2553530 CM-31545 | In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. | 3.7.10-3.7.13, 4.1.1-4.2.1 | 3.7.14, 4.3.0 |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553146 CM-31374 | CVE-2020-15166: ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled can take advantage of this flaw to cause a denial of service affecting authenticated and encrypted clients. Vulnerable: <= 4.3.1-4+deb10u1 Fixed: 4.3.1-4+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2553145 CM-31373 | The following vulnerabilities have been announced in the qemu packages, which are available for optional installation: CVE-2020-12829: An integer overflow in the sm501 display device may result in denial of service. CVE-2020-14364: An out-of-bounds write in the USB emulation code may result in guest-to-host code execution. CVE-2020-15863: A buffer overflow in the XGMAC network device may result in denial of service or the execution of arbitrary code. CVE-2020-16092: A triggerable assert in the e1000e and vmxnet3 devices may result in denial of service. Vulnerable: <= 3.1+dfsg-8+deb10u7 Fixed: 3.1+dfsg-8+deb10u8 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552869 CM-31231 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-4.2.1 | 4.3.0 |
| 2552858 CM-31225 | The following vulnerabilities have been announced in the BIND9 server, which is available for optional installation: CVE-2020-8619: an asterisk character in an empty non-terminal can cause an assertion failure, resulting in denial of service. CVE-2020-8622: a truncated TSIG response can lead to an assertion failure, resulting in denial of service. CVE-2020-8623: a flaw in the native PKCS#11 code can lead to a remotely triggerable assertion failure, resulting in denial of service. CVE-2020-8624: update-policy rules of type “subdomain” are enforced incorrectly, allowing updates to all parts of the zone along with the intended subdomain. Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u1 Fixed: 9.11.5.P4+dfsg-5.1+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552817 CM-31192 | CVE-2020-11724: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. Vulnerable: <= 1.14.2-2+deb10u2 Fixed: 1.14.2-2+deb10u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552791 CM-31174 | The following vulnerabilities have been announced in the ghostscript libgs9 package, which is available for optional installation. These can allow an attacker to elevate privileges or cause a denial of service with crafted PS/EPS/PDF files. CVE-2020-16287 CVE-2020-16288 CVE-2020-16289 CVE-2020-16290 CVE-2020-16291 CVE-2020-16292 CVE-2020-16293 CVE-2020-16294 CVE-2020-16295 CVE-2020-16296 CVE-2020-16297 CVE-2020-16298 CVE-2020-16299 CVE-2020-16300 CVE-2020-16301 CVE-2020-16302 CVE-2020-16303 CVE-2020-16304 CVE-2020-16305 CVE-2020-16306 CVE-2020-16307 CVE-2020-16308 CVE-2020-16309 CVE-2020-16310 CVE-2020-17538 Vulnerable: <= 9.27~dfsg-2+deb10u3 Fixed: 9.27~dfsg-2+deb10u4 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552610 CM-31057 | The following vulnerability has been announced: CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c. | 3.7.13-4.2.0 | 4.2.1-4.3.0 |
| 2552608 CM-31055 | The following vulnerability has been announced: CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. Fixed: 5.8.0-cl4.2.1u1, 5.8.0-cl3.7.14u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552555 CM-31038 | The following vulnerability has been announced: CVE-2019-20795: iproute2 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. Vulnerable: <= 4.19.0-cl4u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552407 CM-30957 | The following vulnerability has been announced in the json-c / libjson_c3 packages: CVE-2020-12762: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Vulnerable: 0.12.1+ds-2 Fixed: 0.12.1+ds-2+deb10u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552298 CM-30882 | The following vulnerability has been announced in net-snmp: CVE-2020-15862: A privilege escalation involving the NET-SNMP-EXTEND-MIB support (which is enabled by default at compile-time). The fixed versions disable NET-SNMP-EXTEND-MIB support. Vulnerable: <= 5.8.0-cl3u11, <= 5.8.0-cl4u4 Fixed: 5.8.0-cl3.7.14u3, 5.8.0-cl4.2.1u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552283 CM-30872 | Several vulnerabilities have been discovered in the GRUB2 bootloader. CVE-2020-10713: A flaw in the grub.cfg parsing code was found allowing to break UEFI Secure Boot and load arbitrary code. Details can be found at https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ CVE-2020-14308: It was discovered that grub_malloc does not validate the allocation size allowing for arithmetic overflow and subsequently a heap-based buffer overflow. CVE-2020-14309: An integer overflow in grub_squash_read_symlink may lead to a heap-based buffer overflow. CVE-2020-14310: An integer overflow in read_section_from_string may lead to a heap-based buffer overflow. CVE-2020-14311: An integer overflow in grub_ext2_read_link may lead to a heap-based buffer overflow. CVE-2020-15706: script: Avoid a use-after-free when redefining a function during execution. CVE-2020-15707: An integer overflow flaw was found in the initrd size handling. Vulnerable: <= 2.02+dfsg1-20, <= 2.02+dfsg1-cl4u1 Fixed: 2.02+dfsg1-20+deb10u2, 2.02+dfsg1-cl4.2.1u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552266 CM-30863 | OpenSSH scp is vulnerable to CVE-2020-15778, where clients that have authorized access to the SSH server can execute commands on the server by copying maliciously named files. The two scenarios where an exploit may be useful to an attacker: -The user is authorized to scp but not ssh (based on the command option in the authorized_keys file), so this vulnerability can allow executing a remote command on the target computer when not authorized to do so.-An attacker plants a maliciously named file in a directory tree that someone later uses scp -r to copy over to the target computer.Be aware that restricting users to scp by using the command option in the authorized_keys file is not effective in preventing those users from executing arbitrary commands on the server.If you want to use scp -r to copy directory trees, avoid copying directory trees to which attackers may have added maliciously-named files. Archiving the directory tree with tar, zip, or a similar program, then copying the archive over to be extracted on the server avoids having to use scp -r altogether. In addition, OpenSSH provides sftp, which you can use instead of scp to copy files.To disable scp completely, use /bin/chmod 0 /usr/bin/scp . | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2552248 CM-30856 | The following vulnerability has been announced in NGINX, which is installed by default on Cumulus Linux (however, the default NGINX configuration is not vulnerable, as it does not configure error_page redirection):CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. To work around this issue, do not use error_page redirection in the vulnerable configuration. https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf describes the vulnerability and the vulnerable configuration.Fixed: 1.14.2-2+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552214 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14, 4.1.1-4.3.0 | 3.7.14.2 |
| 2552213 | The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2552206 CM-30827 | If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552203 CM-30826 | The following vulnerability has been announced in QEMU: CVE-2020-8608: In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. Vulnerable: <= 3.1+dfsg-8+deb10u6 Fixed: 3.1+dfsg-8+deb10u7 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551896 CM-30565 | Several denial of service vulnerabilities have been announced in the qemu packages:CVE-2020-10756 CVE-2020-13361 CVE-2020-13362 CVE-2020-13754 CVE-2020-13659 Vulnerable: <= 1:3.1+dfsg-8+deb10u5 Fixed: 1:3.1+dfsg-8+deb10u6 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551853 CM-30546 | The following vulnerabilities have been announced in the nss packages, including libnss3, which may be used by other programs:CVE-2019-17006: Check length of inputs for cryptographic primitives CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. CVE-2020-12399: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. CVE-2020-12402: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Vulnerable: <= 3.42.1-1+deb10u2 Fixed: 3.42.1-1+deb10u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551771 CM-30525 | When a specific PIM join/prune packet is received from a PIM neighbor the pimd process might crash with a core file. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2551748 CM-30514 | In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2551732 CM-30504 | When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551729 CM-30503 | In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551715 CM-30498 | There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551693 CM-30486 | A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. | 3.7.12-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551686 CM-30484 | Multiple vulnerabilities have been discovered in the Xen hypervisor, which might result in denial of service, guest-to-host privilege escalation, or information leaks. The CVE IDs are CVE-2020-11739, CVE-2020-11740, CVE-2020-11741, CVE-2020-11742, CVE-2020-11743, CVE-2020-15563, CVE-2020-15564, CVE-2020-15565, CVE-2020-15566, CVE-2020-15567. Xen packages are not installed by default on Cumulus Linux, but some libxen* packages are in the repository for optional installation. Vulnerable: < 4.11.3+24-g14b62ab3e5-1~deb10u1 Fixed: 4.11.4+24-gddaaccbbab-1~deb10u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551666 CM-30473 | If you modify an interface name, then reuse the previous interface name for a different VLAN, the ifreload -a command generates an error similar to the following:
| 4.1.0-4.3.0 | |
| 2551665 CM-30472 | On the QuantaMesh T1048-LY4 switch, pluggables inserted into SFP+ ports are not detected. To workaround this issue, downgrade to Cumulus Linux 3.7 ESR. | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551651 CM-30464 | The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551613 CM-30447 | The following vulnerabilities have been announced in ruby2.5, which is not installed on the switch by default, but is available in the repository for optional installation:CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. CVE-2020-10933: An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter. Vulnerable: <= 2.5.5-3+deb10u1 Fixed: 2.5.5-3+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551422 CM-30361 | On Mellanox switches with the Spectrum-2 switch, the lpm-balanced forwarding profile does not work. | 4.1.1-4.2.1 | 4.3.0 |
| 2551387 CM-30340 | When you try to retrieve the Q-BRIDGE-MIB::dot1qTpFdbTable (1.3.6.1.2.1.17.7.1.2.2), snmpd does not return any results. | 4.1.1 | 4.2.0-4.3.0 |
| 2551335 CM-30312 | When TACACS+ is configured and the management VRF is enabled, users with privilege level 13 are prevented from running ip and cat commands. | 4.0.0-4.3.0 | |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2551290 CM-30287 | Non SFF-8634/SFF-8636 compliant 40G AOC modules might not link up when inserted into the Mellanox SN3700 switch. The EEPROM bytes for RX amplitude control (page 03h, bytes #236-239) are defined as volatile in the SFF specification (SFF-8634/8636); after the module power is off, the EEPROM values should return to their defaults. However, these bytes are observed to be non-volatile in the modules listed below. - Mellanox MFP4R12CB-0XX (Luxtera) - AVAGO AFBR-79Q4PACXXZ https://www.finisar.com/sites/default/files/downloads/fcbg410qb1cxx_quadwire_40gbs_parallel_active_optical_cable_product_spec_revb7.pdf https://www.mouser.com/ProductDetail/Finisar/FCBN410QB1C03?qs=D%252B6gCNt%2Fg2BZq7qPdKrYVA%3D%3D Because the modules listed above do not return to their default values correctly when they are unplugged and re-inserted, a cable might become unusable until it is reprogramed. | 4.1.1-4.2.0 | 4.2.1-4.3.0 |
| 2551273 CM-30280 | On a Mellanox SN2010 switch, the Locator LED is on after you upgrade Cumulus Linux. | 4.1.0-4.3.0 | |
| 2551187 CM-30247 | dot1qVlanIndex in the dot1qVlanStaticTable of the SNMP Q-BRIDGE-MIB does not use VLAN ID and does not comply with RFC 4363. | 4.1.1-4.2.1 | 4.3.0 |
| 2551162 CM-30240 | switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. | 3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2551124 CM-30231 | When the dynamic or static flag on a bridge fdb (MAC) entry is changed to the opposite state, the new flag is not set appropriately in hardware. This can allow a static fdb entry to be unexpectedly learned dynamically on a different interface, or can prevent a dynamic entry from being updated or learned elsewhere. This condition can occur during a manual replacement of a local MAC address or when EVPN updates a dynamic MAC address to add or remove the Sticky Mac flag. Either situation results in the MAC address keeping the original flag in hardware. To work around this issue, delete or withdraw the fdb entry, then add the static MAC address directly. For example:
If you are unable to delete an EVPN-learned remote MAC address, you can replace the dynamic MAC address with a local static one, then delete the static MAC address. For example:
| 4.0.0-4.2.1 | 4.3.0 |
| 2551111 CM-30230 | If a remote EVPN Sticky MAC [Static MAC address] is unexpectedly learned dynamically on a local interface, the selected entries in zebra and BGP are in an inconsistent state. zebra increments the local MAC mobility sequence number and considers the MAC address to be local, but BGP maintains the remote Sticky MAC as the best path selected. This results in zebra installing the local MAC address and BGP not updating the route for the MAC address. | 4.0.0-4.2.1 | 4.3.0 |
| 2550974 CM-30195 | On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.14.2, 4.1.1-4.3.0 | |
| 2550973 CM-30194 | After you enable ROCE with the net add interface command, you cannot verify the command because it is not shown in the net show config command output. | 4.1.1-4.2.1 | 4.3.0 |
| 2550950 CM-30182 | The net show time ntp servers command does not show any output with management VRF. | 4.1.1-4.3.0 | |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550918 CM-30164 | The /usr/share/zoneinfo/leap-seconds.list file expires periodically and results in log messages being generated about that expiration.To work around this issue, you must update the file from https://www.ietf.org/timezones/data/leap-seconds.list or upgrade the tzdata package to the newest version. | 4.0.0-4.2.1 | 4.3.0 |
| 2550906 CM-30159 | After you delete a bond, the deleted bond members have the deleted bond MAC address instead of their original MAC address, which might result in traffic being discarded. To work around this issue, perform a full switch restart. | 4.1.1-4.2.1 | 4.3.0 |
| 2550873 CM-30141 | In an MLAG configuration with static VXLAN, static tunnels become unreachable. | 3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550771 CM-30089 | Cumulus Linux supports a maximum of 300 ACLs for use with 802.1X interfaces. This limit encompasses the default ACLs, pre-auth ACLs and dynamic ACLs. Exceeding this limit can affect the performance of the switch. | 4.1.0-4.3.0 | |
| 2550713 CM-30052 | Configuring the subinterface of a VXLAN uplink under another traditional bridge, which also has the VXLAN VNI enslaved, causes switchd to use high CPU due to very frequent VXLAN tunnel sync events.To work around this issue, do not enslave the subinterface of a VXLAN layer 3 uplink under a traditional bridge in a VXLAN configuration. | 4.1.1-4.3.0 | |
| 2550690 CM-30038 | The following vulnerability has been announced that affects GnuTLS: CVE-2020-13777: GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. Vulnerable: <= 3.6.7-4+deb10u3 Fixed: 3.6.7-4+deb10u4 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550634 CM-30000 | When VRF route leaking is configured, iBGP sessions might reset with the peer reporting:
The error is triggered by an UPDATE message that contains the EXTENDED_COMMUNITIES attribute with an empty list of extended communities. To work around this issue, apply an extended community with a route map using import in the importing VRF address family. Make sure that the route map contains the set extended community rt value:vaue command; for example, set extended community rt 11:22. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2550606 CM-29982 | A VRRP role change over the EVPN network causes excessive BGP updates and connectivity issues to VIP for about one minute. | 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550466 CM-29890 | Multiple paths to identical EVPN prefixes are either not displayed or not accepted into the l2vpn evpn table if they are received from a different AS. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550378 CM-29841 | The following vulnerabilities have been announced that affect Unbound: CVE-2020-12662 and CVE-2020-12663 have been discovered in Unbound, a recursive-only caching DNS server; a traffic amplification attack against third party authoritative name servers (NXNSAttack) and insufficient sanitisation of replies from upstream servers could result in denial of service via an infinite loop. Unbound is not provided for Cumulus Linux, but the libunbound8 library package is available for optional installation on Cumulus Linux. Vulnerable: <= 1.9.0-2+deb10u1 Fixed: 1.9.0-2+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550324 CM-29808 | On the Mellanox switches with BFD configured, you might see high load averages. | 4.1.1 | 4.2.0-4.3.0 |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550275 CM-29778 | If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2550264 CM-29774 | The sx_sdk service may log errors and/or generate a core file when configuring breakout ports on Mellanox Spectrum platforms. The error message observed will be similar to the following:sx_sdk: EMAD_RX_THREAD: EMAD transaction FW errorThis issue is resolved in Cumulus Linux 4.2.0 and above. | 4.1.1 | 4.2.0-4.3.0 |
| 2550244 CM-29760 | Several vulnerabilities were discovered in BIND, a DNS server implementation.bind9-host (containing only /usr/bin/host) and some libraries from the bind9 source package are installed on the switch by default; the BIND server referred to in these vulnerabilities is not installed by default but is available in the repository for optional installation.CVE-2019-6477: It was discovered that TCP-pipelined queries can bypass tcp-client limits resulting in denial of service. CVE-2020-8616: It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. CVE-2020-8617: It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service. Vulnerable: 9.11.5.P4+dfsg-5.1 Fixed: 9.11.5.P4+dfsg-5.1+deb10u1 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550117 CM-29691 | The following vulnerability has been announced in the apt package: CVE-2020-3810: Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files. Vulnerable: <= 1.8.2 Fixed: 1.8.2.1 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550056 CM-29652 | The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549958 CM-29603 | When you move an interface from one VRF to another and modify the description in the same configuration operation, FRR crashes and restarts during a service reload. If these two changes occur in separate reloads, FRR does not crash. | 4.1.1 | 4.2.0-4.3.0 |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549894 CM-29576 | The Conntrack table fills up with OFFLOAD entries for flows that do not match the NAT rules in iptables. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549878 CM-29568 | When NAT is configured, non-NAT traffic is incorrectly forwarded to the CPU. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549872 CM-29562 | If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. | 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549794 CM-29525 | The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
| 3.7.11-3.7.13, 4.1.1-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2549784 CM-29520 | On Mellanox switches, when the networking service and switchd starts up, a rare condition might occur where switchd crashes and the following log message is generated:
| 4.1.0-4.2.1 | 4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549776 CM-29513 | Configuration of interfaces fails to apply when you set FEC. You see a message similar to the following:
To work around this issue, reapply the configuration with NCLU and run the net commit or ifreload -a a second time to allow the interface configuration to apply. | 4.1.1 | 4.2.0-4.3.0 |
| 2549731 CM-29492 | When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
| 3.7.12-3.7.14.2, 4.1.1-4.3.0 | |
| 2549712 CM-29485 | The following vulnerability affects the openldap package: CVE-2020-12243: A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash). Vulnerable: <= 2.4.47+dfsg-3+deb10u1 Fixed: 2.4.47+dfsg-3+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549671 CM-29468 | On the Dell S4148T optical module, the low power polarity bit is set incorrectly and the switch port does not come up. To work around this issue, edit the /etc/hw_init.d/S10qsfp_init.sh file and change the lpmode line to be 0x3f instead of 0x00:
Reboot the switch and check that the switch port comes up. Important: Before upgrading Cumulus Linux 4.x with Debian packages that includes a fix for this problem, you must change the lpmode line back to 0x00. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549656 CM-29460 | The following security vulnerabilities affect qemu packages, which are available for optional installation on Cumulus Linux: CVE-2019-12068: In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances ’s->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. CVE-2019-15034: hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space. CVE-2019-20382: QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. Vulnerable: <= 3.1+dfsg-8+deb10u4 Fixed: 3.1+dfsg-8+deb10u5 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549577 CM-29420 | When you configure the management interface class (as shown below), eth0 remains in an admin down state on subsequent reboots:
| 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549511 CM-29385 | The following vulnerability affects the openssl package: CVE-2020-1967: Bernd Edlinger discovered that malformed data passed to the SSL_check_chain() function during or after a TLS 1.3 handshake could cause a NULL dereference, resulting in denial of service. Vulnerable: <= 1.1.1d-0+deb10u2 Fixed: 1.1.1d-0+deb10u3 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549392 CM-29319 | When you configure an RD or RT with NCLU, you see duplicate VNI stanzas in the /etc/frr/frr.conf file.To work around this issue, manually edit the etc/frr/frr.conf file to define advertise-all-vni before the RD or RT configuration within the l2vpn EVPN address family, then reload the FRR service with the sudo systemctl reload frr command. | 4.1.0-4.3.0 | |
| 2549385 CM-29312 | FRR incorrectly orders advertise-all-vni to be later in the configuration than manual rd or route-target definitions. This causes the rd or route-target configuration to be misapplied or not applied at all.To work around this issue, when you manually configure the rd or route-target for a VNI, you must manually edit the /etc/frr/frr.conf file to define advertise-all-vni before the rd or route-target configuration within the l2vpn evpn address family. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549347 CM-29296 | The following vulnerabilities have been announced in git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Vulnerable: <= 2.20.1-2+deb10u1 (CVE-2020-5260) <= 2.20.1-2+deb10u2 (CVE-2020-11008) Fixed: 2.20.1-2+deb10u3 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549307 CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549269 CM-29270 | On Mellanox switches with the Spectrum-2 ASIC, when you use more than 16 bonds on the switch, you might experience forwarding issues or see an error similar to the following in switchd.log:
To work around this issue, configure fewer than 16 bonds on a switch. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2548998 CM-29183 | On the Mellanox SN2010 and SN2100 switch, the fan speed might ramp up and down. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548988 CM-29178 | On Mellanox switches, the thermal monitoring script starts in suspended mode and, as a result, the fans run at sixty percent. You also see the following log message:
To work around this issue, run the following command to enable thermal monitoring:
| 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548924 CM-29146 | On the EdgeCore Minipack AS8000, storm control does not restrict unknown unicast, broadcast, or multicast traffic. | 4.1.1-4.3.0 | |
| 2548920 CM-29145 | If you try to remove BFD configuration with a reload, the FRR service fails. The reload action results in a TypeError: expected string or bytes-like object error.You see this issue only if there is default configuration, such as configuration in the /etc/frr/frr.conf file that is suppressed from view in the FRR running configuration.To work around this issue, remove the default configuration lines; for example:
| 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548892 CM-29131 | NTP does not start when you use the default VRF instead of the management VRF. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548674 CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548595 CM-29000 | The net show config and net show time ntp server commands do not show NTP server configuration. | 4.1.0-4.2.0 | 4.2.1-4.3.0 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548561 CM-28982 | On the EdgeCore Minipack-AS8000, when you try to configure ROCEv2, you see errors indicating that PFC is not working properly. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548496 CM-28948 | Cumulus Linux supports a maximum of 300 ACLs for use with 802.1X interfaces. This limit encompasses the default ACLs, pre-auth ACLs and dynamic ACLs. Exceeding this limit can affect the performance of the switch. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548457 CM-28925 | The global MTU setting in the mtu.json file does not take effect on SVI interfaces after ifreload -a.To work around this issue, run sudo systemctl restart networking or restart the switch.Note: A network restart is a disruptive operation. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548422 CM-28900 | You might see a core file in FRRouting related to OSPFv3 if the switch is configured as both an OSPFv3 ABR and ASBR, and other switches in the same area are also configured as both ABR and ASBR. This issue is not seen with a single ABR or ASBR in an area or if there are multiple ASBRs in an area not acting as ABRs. To work around this issue, do not perform redistribution on more than one ABR in the same area. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548408 CM-28891 | net show configuration commands does not show the RoCE net add interface configuration. | 4.1.0-4.2.1 | 4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548373 CM-28862 | On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548320 CM-28821 | When configuring VRF route leaking, if you define import vrf route-map but do not have any imported VRFs, the route map command displays incorrectly, and as a result, FRR fails to reload. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548310 CM-28812 | When the system boots, we might see " cumulus systemd-udevd[7566]: Process ‘/usr/bin/hw-management-thermal-events.sh add thermal_zone /sys /devices/virtual/thermal/thermal_zone25 thermal_zone25’ failed with exit code 1" errors. These errors are result of user space acting on kernel events a bit slow. The mlxsw_minimal driver is added during kernel boot; An SDK reset causes the driver to be deleted and re-instantiated; User space handler for thermal zone add sees the add first; But the underlying device is deleted before it can act on it. This situation is rectified as the mlxsw_minimal driver is re-instantiated later; | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548308 CM-28810 | When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. | 3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548275 CM-28781 | On the QuantaMesh BMS T5032-LY6 switch, when you run the hwclock command, you might see the error hwclock: select() to /dev/rtc0 to wait for clock tick timed out. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548260 CM-28770 | The net add routing route-map command does not add the set statement into the /etc/frr/frr.conf file. | 4.0.0-4.3.0 | |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548242 CM-28753 | On the Mellanox SN3800 switch, when you run sudo -E apt-get update, then sudo -E apt get upgrade, you see a dialog prompting you for the interface on which to run DHCP, followed by a request for DHCP relay options. You can ignore this dialog and press enter to continue with the upgrade. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548197 CM-28717 | On the Mellanox SN3800 switch, when you remove the PSU, smonctl reports that the PSU is BAD instead of ABSENT. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548194 CM-28714 | On the Mellanox SN3800 switch, when you remove a fan tray, smonctl reports that the fan is LOW instead of ABSENT. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548181 CM-28705 | On the Mellanox SN3800 switch, 4x25G DAC breakouts are not supported. | 4.1.0-4.3.0 | |
| 2548152 CM-28682 | On the Mellanox Spectrum switch in an EVPN symmetric configuration with MLAG, simultaneously shutting down the layer 3 interfaces that serve as uplinks to the VXLAN fabric might result in traffic loss of up to 15 seconds. | 4.1.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548113 CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548062 CM-28622 | When ports are split to 4x25G, RS FEC needs to explicitly configured on both ends (especially when interoperating with non-Mellanox switches). | 4.1.0-4.3.0 | |
| 2548060 CM-28620 | On the Mellanox SN3800 switch, links do not come up when the ports are configured for 40G. | 4.1.0-4.3.0 | |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547890 CM-28497 | QinQ across VXLAN on a traditional bridge does not work. | 4.1.0-4.3.0 | |
| 2547881 CM-28489 | The following CVEs were announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages (not enabled by default on Cumulus Linux) with the pmaisforwardedfrom or pmcisconames optional log parsers (also not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows. Vulnerable: 8.1901.0-1 Recommendation: Do not enable receiving syslog messages from other hosts by the network (with $UDPServerRun or $InputTCPServerRun). Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames. The default /etc/rsyslog.conf file on Cumulus Linux does not enable any of these. | 4.0.0-4.3.0 | |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547667 CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547610 CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547405 CM-28226 | When you restart the hsflowd service, you see a systemd warning message similar to the following:
| 4.0.0-4.3.0 | |
| 2547341 CM-28189 | When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
| 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546874 CM-27950 | On the Dell S5232F, S5248F, S5296F, and S3048 switch, using the poweroff or halt commands does not fully power off the switch. | 4.0.0-4.3.0 | |
| 2546485 CM-27753 | The EdgeCore Minipack-AS8000 switch supports FEC RS by default; you cannot disable this setting. However, the ethtool –show-fec command output indicates that FEC is disabled. Also, if you try to change the FEC setting, Cumulus Linux reports an error. For example:
| 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546337 CM-27678 | The net show bridge macs command returns an empty interface column.To work around this issue, run the bridge fdb show command to show the interface. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546261 CM-27642 | The following CVEs were announced that affect the libssh package: CVE-2019-14889 has been announced in the libssh library, where unsanitized user-provided scp command lines could allow an attacker to execute arbitrary commands on the server. The libssh library is not installed on Cumulus Linux by default, but is available in the Cumulus Linux 4 repository for optional installation. Note that libssh is distinct from libssh2 and openssh, which are present on the switches and in the repositories. See the following for more information: https://www.libssh.org/security/advisories/CVE-2019-14889.txt https://security-tracker.debian.org/tracker/CVE-2019-14889 | 4.0.0-4.3.0 | |
| 2546255 CM-27637 | On the EdgeCore Minipack-AS8000 switch, a 100G DAC link does not come up when auto-negotiation is enabled on the neighbor. This switch does not support 100G DAC auto-negotiation at this time. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2545934 CM-27489 | Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. | 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2545837 CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. | 3.7.10-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2545537 CM-27254 | On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2545520 CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2545352 CM-27136 | With a high number of active routes (20K or more), when you perform a networking restart, the FRR log files might become flooded with error messages associated with the restart. These logs are normal and are not directly a problem. However, the large number of messages can cause the logs to rotate away any previous history, which prevents you from tracing back events leading up to the restart. In a troubleshooting environment, this can be problematic. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2545239 CM-27099 | On the Mellanox switch with the Spectrum-2 ASIC, Precision Time Protocol (PTP) is not currently supported. | 4.0.0-4.3.0 | |
| 2545233 CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 4.0.0-4.3.0 | |
| 2545164 CM-27049 | On the Mellanox switch with the Spectrum 2 ASIC, interfaces using 100G or 200G Direct Attach Cables (DACs) do not come up with the interface default configuration. To work around this issue and bring the interfaces up, perform the following configuration on both sides of the link: * Set the interface speed to the desired speed * Set link auto-negotiation to _off_ * Set link FEC to RS mode | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2545012 CM-26942 | Port security is not currently supported on VX. The NCLU commands produce errors. | 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544957 CM-26907 | NCLU incorrectly allows you to apply port security configuration on layer 2 and layer 3 ports that are not part of a bridge. | 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544880 CM-26860 | When you run the NCLU net show commit last or net show commit command, where | 4.0.0-4.3.0 | |
| 2544856 CM-26841 | In the ethool -m output, the Revision Compliance field might show Unallocated when the SFF-8363 Revision Compliance value is SFF-8636 version 2.8 or later. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.14, 4.2.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543401 CM-25986 | On the Mellanox Spectrum-2 switch, the time required to establish a link (from the time a link is set to admin up until the link becomes operationally up) can take up to 15 seconds on 40G interfaces and up to 30 seconds on 100G interfaces.To work around this issue, wait up to 15 seconds on 40G interfaces and 30 seconds on 100G interfaces for the link to establish. | 4.0.0-4.2.1 | 4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542837 CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.3.0 | 3.7.9-3.7.14 |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2536576 CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 4.0.0-4.3.0 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536256 CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.
These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 4.0.0-4.3.0 | |
| 2536242 CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535723 CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 4.0.0-4.3.0 | |
| 2535707 CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2535605 CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 4.0.0-4.3.0 | |
| 2535209 CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.7.5-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2534978 CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2534734 CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 4.0.0-4.3.0 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2533625 CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 4.0.0-4.3.0 | |
| 2533337 CM-19454 | When you use NCLU to bring a bond admin down (net add bond ), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown command. | 4.0.0-4.3.0 | |
| 2531273 CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See [Address Resolution Protocol in the Cumulus Linux user guide|https://docs.cumulusnetworks.com/cumulus-linux/Layer-3/Address-Resolution-Protocol-ARP/] for more information. | 4.0.0-4.3.0 |
Fixed Issues in 4.1.1
| Issue ID | Description | Affects |
|---|---|---|
| 2548933 CM-29151 | The following security vulnerability in the gnutls28 / libgnutls* packages has been announced for Cumulus Linux 4.x (Cumulus Linux 3.x is not vulnerable): CVE-2020-11501: GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 ‘\0’ bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol. Vulnerable: <= 3.6.7-4+deb10u2 Not vulnerable: 3.6.7-4+deb10u3 | 4.0.0-4.1.0 |
| 2548855 CM-29111 | Due to a packaging error, all switches installed from the same Cumulus Linux image have the same SSH host keys. This affects switches originally installed with Cumulus Linux 4.0.0 and 4.1.0 from a disk image only (including those that were upgraded by apt to a later release).As a result, this issue allows an attacker to more easily bypass remote host verification when a user connects by SSH to what is believed to be a previously used remote host but is really the attacker’s host. For example, this issue can be exploited by a spoofing or man-in-the-middle attack. To resolve this issue, generate new SSH host keys for any switch that has Cumulus Linux 4.0.0 or 4.1.0 installed on it:
After generating new SSH host keys, SSH clients that have previously logged into that switch will see a warning that the switch’s SSH host key changed; this is expected behavior. Be sure to inform anyone who may log in to the switch that you generated new SSH host keys. These users must log in to the affected switches with their SSH clients, where they will be given instructions on how to remove the old SSH host keys from the known hosts files to avoid a spoofing or man-in-the-middle attack directed at their SSH clients. *Notes* * This issue is fixed in Cumulus Linux 4.1.1. However, we recommend you generate new SSH host keys as this is the most reliable solution. * If you upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later using apt-get and you didn’t generate new SSH host keys, you will need to generate new SSH host keys after the upgrade.* If you perform a fresh install of Cumulus Linux 4.1.1 or later using a disk image, you will lose your existing local configuration. | 4.0.0-4.1.0 |
| 2548710 CM-29057 | The following vulnerability was reported in the bluez package. No bluez packages are installed by default on Cumulus Linux 4.x, but libbluetooth3 is available from the repository for optional installation. CVE-2020-0556: It was reported that the BlueZ’s HID and HOGP profile implementations don’t specifically require bonding between the device and the host. Malicious devices can take advantage of this flaw to connect to a target host and impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source. | 4.0.0-4.1.0 |
| 2548655 CM-29033 | When using apt-get update && apt-get upgrade to upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later, a message similar to the following may appear.
To work around this issue and proceed with the upgrade, run apt-get update –allow-releaseinfo-change. | 4.0.0-4.1.0 |
| 2548579 CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.7.12, 4.0.0-4.1.0 |
4.1.0 Release Notes
Open issues in 4.1.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| CM-28249 | On the Mellanox switch, when you modify the buffer and queue configuration without restarting switchd, you might see a one second interruption in forwarding. | 4.0.0-4.3.0 | |
| CM-28080 | TACACS+ through ClearPass is not currently supported. Cumulus Linux sends authorization before authentication, but ClearPass does not accept an authorization before the user is authenticated. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| CM-21678 | On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty:
This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20508 | The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. | 3.5.3-3.7.14.2, 4.0.0-4.3.0 | |
| CM-20033 | The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down | 3.5.2-3.7.14.2, 4.0.0-4.3.0 | |
| CM-15812 | Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. | 3.2.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2595889 CM-31120 | In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. | 3.7.10-4.2.1 | 4.3.0 |
| 2595816 CM-31222 | Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0 |
| 2589747 CM-32226 | If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. | 3.7.12-4.2.1 | 4.3.0 |
| 2578872 | CVE-2021-20270: It was discovered that Pygments, a syntax highlighting package written in Python, could be forced into an infinite loop, resulting in denial of service Vulnerable: 2.3.1+dfsg-1Fixed: 2.3.1+dfsg-1+deb10u1 | 4.0.0-4.3.0 | |
| 2578870 | CVE-2020-35523 CVE-2020-35524: Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed Vulnerable: <= 4.1.0+git191117-2~deb10u1Fixed: 4.1.0+git191117-2~deb10u2 | 4.0.0-4.3.0 | |
| 2566880 | CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2564839 | Several vulnerabilities have been discovered in the GRUB2 bootloader:CVE-2020-14372: It was discovered that the acpi command allows a privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-25632: A use-after-free vulnerability was found in the rmmod command CVE-2020-25647: An out-of-bound write vulnerability was found in the grub_usb_device_initialize() function, which is called to handle USB device initialization CVE-2020-27749: A stack buffer overflow flaw was found in grub_parser_split_cmdline CVE-2020-27779: It was discovered that the cutmem command allows a privileged user to remove memory regions when Secure Boot is enabled CVE-2021-20225: A heap out-of-bounds write vulnerability was found in the short form option parser CVE-2021-20233: A heap out-of-bound write flaw was found caused by mis-calculation of space required for quoting in the menu rendering. | 4.0.0-4.3.0 | |
| 2556783 CM-33398 | CVE-2021-0326: An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution. Vulnerable: <= 2.8.0-cl3.7.14u1, <= 2.8.0-cl4.2.1u1 | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556778 CM-33395 | CVE-2021-26937: A flaw in the handling of combining characters in screen, a terminal multiplexer with VT100/ANSI terminal emulation can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence. Vulnerable: 4.6.2-3 Fixed: 4.6.2-3+deb10u1 | 4.0.0-4.3.0 | |
| 2556776 CM-33394 | CVE-2021-27212: A vulnerability in the Certificate List Exact Assertion validation was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of this flaw to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u5 Fixed: 2.4.47+dfsg-3+deb10u6 | 4.0.0-4.3.0 | |
| 2556775 CM-33393 | DSA-4859-1 (no CVE): zstd, a compression utility, was vulnerable to a race condition: it temporarily exposed, during a very short timeframe, a world-readable version of its input even if the original file had restrictive permissions. Vulnerable: <= 1.3.8+dfsg-3+deb10u1 Fixed: 1.3.8+dfsg-3+deb10u2 | 4.0.0-4.3.0 | |
| 2556764 CM-33385 | In a configuration with both traditional and vlan-aware bridges, the VLAN membership check on a vlan-aware switch does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2556731 CM-33359 | CVE-2020-8625: A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, a DNS server implementation, which could result in denial of service (daemon crash), or potentially the execution of arbitrary code. Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u2 Fixed: 9.11.5.P4+dfsg-5.1+deb10u3 | 4.0.0-4.3.0 | |
| 2556691 CM-33334 | The following vulnerabilities have been announced in the openssl packages: CVE-2021-23840: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. CVE-2019-1551: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Vulnerable: <= 1.1.1d-0+deb10u4 Fixed: 1.1.1d-0+deb10u5 | 4.0.0-4.3.0 | |
| 2556659 CM-33315 | CVE-2020-35498: A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Vulnerable: <= 2.8.90-1-cl4u5 | 4.0.0-4.3.0 | |
| 2556569 CM-33283 | DSA-4850-1 (no CVE): libzstd adds read permissions to files while being compressed or uncompressed. Vulnerable: 1.3.8+dfsg-3 Fixed: 1.3.8+dfsg-3+deb10u1 | 4.0.0-4.3.0 | |
| 2556500 CM-33258 | Cumulus Linux does not support bond members at 200G or greater. | 4.0.0-4.3.0 | |
| 2556456 CM-33237 | CVE-2020-36221, CVE-2020-36222, CVE-2020-36223, CVE-2020-36224, CVE-2020-36225, CVE-2020-36226, CVE-2020-36227, CVE-2020-36228, CVE-2020-36229, CVE-2020-36230: Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u4 Fixed: 2.4.47+dfsg-3+deb10u5 | 4.0.0-4.3.0 | |
| 2556279 CM-33160 | CVE-2021-3156: A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug. Vulnerable: <= 1.8.27-1+deb10u2 Fixed: 1.8.27-1+deb10u3 | 4.0.0-4.2.1 | 4.3.0 |
| 2556218 CM-33117 | The following vulnerability affects lldpd: CVE-2020-27827: A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Fixed: 1.0.4-0-cl4.3.0u2 | 3.7.14-4.2.1 | 4.3.0 |
| 2556037 CM-33012 | After you add an interface to the bridge, an OSPF session flap can occur. | 3.7.9-4.2.0 | 4.2.1-4.3.0 |
| 2556012 CM-32994 | On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. | 3.7.14, 4.0.0-4.2.1 | 3.7.14.2, 4.3.0 |
| 2555761 CM-32860 | The following vulnerabilities were announced in the p11-kit (libp11-kit0) packages: CVE-2020-29361: Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. CVE-2020-29362: A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation. CVE-2020-29363: A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value. Vulnerable: 0.23.15-2 Fixed: 0.23.15-2_deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2555691 CM-32829 | The NET-SNMP-EXTEND-MIB, disabled in Cumulus Linux 4.2.1 and 3.7.14 to prevent security vulnerability CVE-2020-15862, is re-enabled read-only. | 3.7.14-4.2.1 | 4.3.0 |
| 2555528 CM-32750 | In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. | 3.7.14-4.2.1 | 4.3.0 |
| 2555506 CM-32733 | CVE-2020-29479 CVE-2020-29480 CVE-2020-29481 CVE-2020-29482 CVE-2020-29483 CVE-2020-29484 CVE-2020-29485 CVE-2020-29486 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Several security issues affecting Xenstore could result in cross domain access (denial of service, information leaks or privilege escalation) or denial of service against xenstored. Additional vulnerabilities could result in guest-to-host denial of service. Vulnerable: <= 4.11.4+57-g41a822c392-1 Fixed: 4.11.4+57-g41a822c392-2 | 4.0.0-4.2.1 | 4.3.0 |
| 2555428 CM-32683 | When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. | 3.7.13-4.2.1 | 4.3.0 |
| 2555401 CM-32661 | On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0 |
| 2555373 CM-32641 | CVE-2020-27350: Missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. CVE-2020-27351: Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service. Vulnerable: apt <= 1.8.2.1, python-apt <= 1.8.4.1 Fixed: apt 1.8.2.2, python-apt 1.8.4.3 | 4.0.0-4.2.1 | 4.3.0 |
| 2555339 CM-32622 | The following vulnerability has been announced in OpenSSL: CVE-2020-1971: A flaw in the GENERAL_NAME_cmp() function could cause a NULL dereference when both GENERAL_NAMEs contain an EDIPARTYNAME, resulting in denial of service. More information can be found at https://www.openssl.org/news/secadv/20201208.txt . Vulnerable: <= 1.1.1d-0+deb10u3 Fixed: 1.1.1d-0+deb10u4 | 4.0.0-4.2.1 | 4.3.0 |
| 2555270 CM-32592 | CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27674 CVE-2020-28368: Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or information leaks. Vulnerable: < 4.11.4+57-g41a822c392-1 Fixed: 4.11.4+57-g41a822c392-1 | 4.0.0-4.2.1 | 4.3.0 |
| 2555183 CM-32532 | CVE-2020-8927: A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a “one-shot” decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. If one cannot update to a fixed version, we recommend to use the “streaming” API as opposed to the “one-shot” API, and impose chunk size limits. Vulnerable: 1.0.7-2 Fixed: 1.0.7-2+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554992 CM-32420 | When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. | 3.7.13-4.2.1 | 4.3.0 |
| 2554982 CM-32412 | CVE-2020-28196: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. Vulnerable: 1.17-3 Fixed: 1.17-3+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554834 CM-32311 | CVE-2020-25709, CVE-2020-25710: Two vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets. Vulnerable: <= 2.4.47+dfsg-3+deb10u3 Fixed: 2.4.47+dfsg-3+deb10u4 | 4.0.0-4.2.1 | 4.3.0 |
| 2554785 CM-32275 | After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
| 3.7.11-4.2.1 | 4.3.0 |
| 2554707 CM-32215 | On the Dell S5048F-ON switch, optical transceivers do not come up and the modules are in reset mode. | 4.0.0-4.2.1 | 4.3.0 |
| 2554617 CM-32169 | OpenSSH is vulnerable to CVE-2020-14145, as described in https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf. This is an information leak in algorithm negotiation that can allow man-in-the-middle attacks on initial connection attempts without a previously stored server host key on the client. If desired, mitigation using UpdateHostKeys and HostKeyAlgorithms is also given in that paper. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2554588 CM-32149 | If you try reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running.To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
to:
| 3.7.13-4.2.1 | 4.3.0 |
| 2554533 CM-32112 | On the ARM platform, NTP peer associations slowly increase to larger offsets (~500ms). | 4.0.0-4.3.0 | |
| 2554531 CM-32110 | CVE-2020-25692: A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet. The slapd package is not present in the image or repository, although the OpenLDAP libraries are present. Vulnerable: <= 2.4.47+dfsg-3+deb10u2 Fixed: 2.4.47+dfsg-3+deb10u3 | 4.0.0-4.2.1 | 4.3.0 |
| 2554369 CM-32006 | Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. | 3.7.12-4.2.1 | 4.3.0 |
| 2554307 CM-31968 | The following vulnerability has been announced in freetype: CVE-2020-15999: Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. Vulnerable: <= 2.9.1-3+deb10u1 Fixed: 2.9.1-3+deb10u2 | 4.0.0-4.2.1 | 4.3.0 |
| 2554282 CM-31954 | A security issue was discovered in the MariaDB database server. Vulnerable: 10.3.25-0 Fixed: 10.3.25-0+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2554131 CM-31864 | CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Vulnerable: 0.14.0-1.3 Fixed: 0.14.0-1.3+deb10u1 | 4.0.0-4.2.1 | 4.3.0 |
| 2553887 CM-31700 | When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2553878 CM-31697 | Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. These include the following:CVE-2020-25595, CVE-2020-25596, CVE-2020-25597, CVE-2020-25599, CVE-2020-25600, CVE-2020-25601, CVE-2020-25602, CVE-2020-25603, CVE-2020-25604. Vulnerable: < 4.11.4+37-g3263f257ca-1 Fixed: 4.11.4+37-g3263f257ca-1 | 4.0.0-4.2.1 | 4.3.0 |
| 2553748 CM-31627 | On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2553732 CM-31618 | A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553677 CM-31605 | When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. | 3.7.13-3.7.14.2, 4.0.0-4.3.0 | |
| 2553588 CM-31565 | Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2553219 CM-31407 | You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0 |
| 2553146 CM-31374 | CVE-2020-15166: ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled can take advantage of this flaw to cause a denial of service affecting authenticated and encrypted clients. Vulnerable: <= 4.3.1-4+deb10u1 Fixed: 4.3.1-4+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2553145 CM-31373 | The following vulnerabilities have been announced in the qemu packages, which are available for optional installation: CVE-2020-12829: An integer overflow in the sm501 display device may result in denial of service. CVE-2020-14364: An out-of-bounds write in the USB emulation code may result in guest-to-host code execution. CVE-2020-15863: A buffer overflow in the XGMAC network device may result in denial of service or the execution of arbitrary code. CVE-2020-16092: A triggerable assert in the e1000e and vmxnet3 devices may result in denial of service. Vulnerable: <= 3.1+dfsg-8+deb10u7 Fixed: 3.1+dfsg-8+deb10u8 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2553116 CM-31357 | When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552939 CM-31263 | RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0 |
| 2552869 CM-31231 | On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. | 3.7.13-4.2.1 | 4.3.0 |
| 2552858 CM-31225 | The following vulnerabilities have been announced in the BIND9 server, which is available for optional installation: CVE-2020-8619: an asterisk character in an empty non-terminal can cause an assertion failure, resulting in denial of service. CVE-2020-8622: a truncated TSIG response can lead to an assertion failure, resulting in denial of service. CVE-2020-8623: a flaw in the native PKCS#11 code can lead to a remotely triggerable assertion failure, resulting in denial of service. CVE-2020-8624: update-policy rules of type “subdomain” are enforced incorrectly, allowing updates to all parts of the zone along with the intended subdomain. Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u1 Fixed: 9.11.5.P4+dfsg-5.1+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552817 CM-31192 | CVE-2020-11724: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. Vulnerable: <= 1.14.2-2+deb10u2 Fixed: 1.14.2-2+deb10u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552791 CM-31174 | The following vulnerabilities have been announced in the ghostscript libgs9 package, which is available for optional installation. These can allow an attacker to elevate privileges or cause a denial of service with crafted PS/EPS/PDF files. CVE-2020-16287 CVE-2020-16288 CVE-2020-16289 CVE-2020-16290 CVE-2020-16291 CVE-2020-16292 CVE-2020-16293 CVE-2020-16294 CVE-2020-16295 CVE-2020-16296 CVE-2020-16297 CVE-2020-16298 CVE-2020-16299 CVE-2020-16300 CVE-2020-16301 CVE-2020-16302 CVE-2020-16303 CVE-2020-16304 CVE-2020-16305 CVE-2020-16306 CVE-2020-16307 CVE-2020-16308 CVE-2020-16309 CVE-2020-16310 CVE-2020-17538 Vulnerable: <= 9.27~dfsg-2+deb10u3 Fixed: 9.27~dfsg-2+deb10u4 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552742 CM-31150 | On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. | 3.7.12-4.2.1 | 4.3.0 |
| 2552632 CM-31073 | When you set the sysctl settings net.ipv6.conf.all.accept_ra_defrtr (to prevent acceptance of IPv6 default route advertisements) and net.ipv6.conf.default.accept_ra_defrtr (set for newly created interfaces), if you create a new virtual interface, any pre-existing interface does not start accepting IPv6 default route avertisements again.To work around this issue, when you create a new virtual interface, set net.ipv6.conf. to 0 for all interfaces and run sysctl -p –system. | 3.7.12-4.2.1 | 4.3.0 |
| 2552610 CM-31057 | The following vulnerability has been announced: CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c. | 3.7.13-4.2.0 | 4.2.1-4.3.0 |
| 2552608 CM-31055 | The following vulnerability has been announced: CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. Fixed: 5.8.0-cl4.2.1u1, 5.8.0-cl3.7.14u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552555 CM-31038 | The following vulnerability has been announced: CVE-2019-20795: iproute2 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. Vulnerable: <= 4.19.0-cl4u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552528 CM-31028 | Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2552506 CM-31016 | Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. | 3.7.11-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552407 CM-30957 | The following vulnerability has been announced in the json-c / libjson_c3 packages: CVE-2020-12762: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Vulnerable: 0.12.1+ds-2 Fixed: 0.12.1+ds-2+deb10u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552298 CM-30882 | The following vulnerability has been announced in net-snmp: CVE-2020-15862: A privilege escalation involving the NET-SNMP-EXTEND-MIB support (which is enabled by default at compile-time). The fixed versions disable NET-SNMP-EXTEND-MIB support. Vulnerable: <= 5.8.0-cl3u11, <= 5.8.0-cl4u4 Fixed: 5.8.0-cl3.7.14u3, 5.8.0-cl4.2.1u1 | 3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552294 CM-30879 | NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2552283 CM-30872 | Several vulnerabilities have been discovered in the GRUB2 bootloader. CVE-2020-10713: A flaw in the grub.cfg parsing code was found allowing to break UEFI Secure Boot and load arbitrary code. Details can be found at https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ CVE-2020-14308: It was discovered that grub_malloc does not validate the allocation size allowing for arithmetic overflow and subsequently a heap-based buffer overflow. CVE-2020-14309: An integer overflow in grub_squash_read_symlink may lead to a heap-based buffer overflow. CVE-2020-14310: An integer overflow in read_section_from_string may lead to a heap-based buffer overflow. CVE-2020-14311: An integer overflow in grub_ext2_read_link may lead to a heap-based buffer overflow. CVE-2020-15706: script: Avoid a use-after-free when redefining a function during execution. CVE-2020-15707: An integer overflow flaw was found in the initrd size handling. Vulnerable: <= 2.02+dfsg1-20, <= 2.02+dfsg1-cl4u1 Fixed: 2.02+dfsg1-20+deb10u2, 2.02+dfsg1-cl4.2.1u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552266 CM-30863 | OpenSSH scp is vulnerable to CVE-2020-15778, where clients that have authorized access to the SSH server can execute commands on the server by copying maliciously named files. The two scenarios where an exploit may be useful to an attacker: -The user is authorized to scp but not ssh (based on the command option in the authorized_keys file), so this vulnerability can allow executing a remote command on the target computer when not authorized to do so.-An attacker plants a maliciously named file in a directory tree that someone later uses scp -r to copy over to the target computer.Be aware that restricting users to scp by using the command option in the authorized_keys file is not effective in preventing those users from executing arbitrary commands on the server.If you want to use scp -r to copy directory trees, avoid copying directory trees to which attackers may have added maliciously-named files. Archiving the directory tree with tar, zip, or a similar program, then copying the archive over to be extracted on the server avoids having to use scp -r altogether. In addition, OpenSSH provides sftp, which you can use instead of scp to copy files.To disable scp completely, use /bin/chmod 0 /usr/bin/scp . | 3.7.14-3.7.14.2, 4.0.0-4.3.0 | |
| 2552248 CM-30856 | The following vulnerability has been announced in NGINX, which is installed by default on Cumulus Linux (however, the default NGINX configuration is not vulnerable, as it does not configure error_page redirection):CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. To work around this issue, do not use error_page redirection in the vulnerable configuration. https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf describes the vulnerability and the vulnerable configuration.Fixed: 1.14.2-2+deb10u2 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2552206 CM-30827 | If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2552203 CM-30826 | The following vulnerability has been announced in QEMU: CVE-2020-8608: In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. Vulnerable: <= 3.1+dfsg-8+deb10u6 Fixed: 3.1+dfsg-8+deb10u7 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551912 CM-30580 | ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. | 3.7.12-4.2.0 | 4.2.1-4.3.0 |
| 2551896 CM-30565 | Several denial of service vulnerabilities have been announced in the qemu packages:CVE-2020-10756 CVE-2020-13361 CVE-2020-13362 CVE-2020-13754 CVE-2020-13659 Vulnerable: <= 1:3.1+dfsg-8+deb10u5 Fixed: 1:3.1+dfsg-8+deb10u6 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551853 CM-30546 | The following vulnerabilities have been announced in the nss packages, including libnss3, which may be used by other programs:CVE-2019-17006: Check length of inputs for cryptographic primitives CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. CVE-2020-12399: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. CVE-2020-12402: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Vulnerable: <= 3.42.1-1+deb10u2 Fixed: 3.42.1-1+deb10u3 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551771 CM-30525 | When a specific PIM join/prune packet is received from a PIM neighbor the pimd process might crash with a core file. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2551748 CM-30514 | In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. | 3.7.12-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2551732 CM-30504 | When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551729 CM-30503 | In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551715 CM-30498 | There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551686 CM-30484 | Multiple vulnerabilities have been discovered in the Xen hypervisor, which might result in denial of service, guest-to-host privilege escalation, or information leaks. The CVE IDs are CVE-2020-11739, CVE-2020-11740, CVE-2020-11741, CVE-2020-11742, CVE-2020-11743, CVE-2020-15563, CVE-2020-15564, CVE-2020-15565, CVE-2020-15566, CVE-2020-15567. Xen packages are not installed by default on Cumulus Linux, but some libxen* packages are in the repository for optional installation. Vulnerable: < 4.11.3+24-g14b62ab3e5-1~deb10u1 Fixed: 4.11.4+24-gddaaccbbab-1~deb10u1 | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551675 CM-30479 | When you restart clagd, the edge port setting on the peer link changes. | 3.7.2-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551666 CM-30473 | If you modify an interface name, then reuse the previous interface name for a different VLAN, the ifreload -a command generates an error similar to the following:
| 4.1.0-4.3.0 | |
| 2551665 CM-30472 | On the QuantaMesh T1048-LY4 switch, pluggables inserted into SFP+ ports are not detected. To workaround this issue, downgrade to Cumulus Linux 3.7 ESR. | 4.0.0-4.2.0 | 4.2.1-4.3.0 |
| 2551651 CM-30464 | The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. | 3.7.12-3.7.13, 4.0.0-4.2.0 | 3.7.14, 4.2.1-4.3.0 |
| 2551613 CM-30447 | The following vulnerabilities have been announced in ruby2.5, which is not installed on the switch by default, but is available in the repository for optional installation:CVE-2020-10663: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. CVE-2020-10933: An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter. Vulnerable: <= 2.5.5-3+deb10u1 Fixed: 2.5.5-3+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2551578 CM-30422 | When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2551335 CM-30312 | When TACACS+ is configured and the management VRF is enabled, users with privilege level 13 are prevented from running ip and cat commands. | 4.0.0-4.3.0 | |
| 2551305 CM-30296 | The net show configuration command provides the wrong net add command for ACL under the VLAN interface. | 3.7.12-3.7.14.2, 4.1.0-4.3.0 | |
| 2551273 CM-30280 | On a Mellanox SN2010 switch, the Locator LED is on after you upgrade Cumulus Linux. | 4.1.0-4.3.0 | |
| 2551162 CM-30240 | switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. | 3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2551124 CM-30231 | When the dynamic or static flag on a bridge fdb (MAC) entry is changed to the opposite state, the new flag is not set appropriately in hardware. This can allow a static fdb entry to be unexpectedly learned dynamically on a different interface, or can prevent a dynamic entry from being updated or learned elsewhere. This condition can occur during a manual replacement of a local MAC address or when EVPN updates a dynamic MAC address to add or remove the Sticky Mac flag. Either situation results in the MAC address keeping the original flag in hardware. To work around this issue, delete or withdraw the fdb entry, then add the static MAC address directly. For example:
If you are unable to delete an EVPN-learned remote MAC address, you can replace the dynamic MAC address with a local static one, then delete the static MAC address. For example:
| 4.0.0-4.2.1 | 4.3.0 |
| 2551111 CM-30230 | If a remote EVPN Sticky MAC [Static MAC address] is unexpectedly learned dynamically on a local interface, the selected entries in zebra and BGP are in an inconsistent state. zebra increments the local MAC mobility sequence number and considers the MAC address to be local, but BGP maintains the remote Sticky MAC as the best path selected. This results in zebra installing the local MAC address and BGP not updating the route for the MAC address. | 4.0.0-4.2.1 | 4.3.0 |
| 2550942 CM-30178 | NCLU tab completion for net show displays the text add help text instead of system Information for the system option. | 3.7.11-4.2.0 | 4.2.1-4.3.0 |
| 2550918 CM-30164 | The /usr/share/zoneinfo/leap-seconds.list file expires periodically and results in log messages being generated about that expiration.To work around this issue, you must update the file from https://www.ietf.org/timezones/data/leap-seconds.list or upgrade the tzdata package to the newest version. | 4.0.0-4.2.1 | 4.3.0 |
| 2550796 CM-30103 | On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. | 3.7.12-4.2.1 | 4.3.0 |
| 2550793 CM-30101 | The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550771 CM-30089 | Cumulus Linux supports a maximum of 300 ACLs for use with 802.1X interfaces. This limit encompasses the default ACLs, pre-auth ACLs and dynamic ACLs. Exceeding this limit can affect the performance of the switch. | 4.1.0-4.3.0 | |
| 2550690 CM-30038 | The following vulnerability has been announced that affects GnuTLS: CVE-2020-13777: GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. Vulnerable: <= 3.6.7-4+deb10u3 Fixed: 3.6.7-4+deb10u4 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550634 CM-30000 | When VRF route leaking is configured, iBGP sessions might reset with the peer reporting:
The error is triggered by an UPDATE message that contains the EXTENDED_COMMUNITIES attribute with an empty list of extended communities. To work around this issue, apply an extended community with a route map using import in the importing VRF address family. Make sure that the route map contains the set extended community rt value:vaue command; for example, set extended community rt 11:22. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2550601 CM-29978 | The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2550479 CM-29899 | VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.3.0, 4.3.0 |
| 2550444 CM-29872 | Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550443 CM-29871 | The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550378 CM-29841 | The following vulnerabilities have been announced that affect Unbound: CVE-2020-12662 and CVE-2020-12663 have been discovered in Unbound, a recursive-only caching DNS server; a traffic amplification attack against third party authoritative name servers (NXNSAttack) and insufficient sanitisation of replies from upstream servers could result in denial of service via an infinite loop. Unbound is not provided for Cumulus Linux, but the libunbound8 library package is available for optional installation on Cumulus Linux. Vulnerable: <= 1.9.0-2+deb10u1 Fixed: 1.9.0-2+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550375 CM-29838 | CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. | 3.7.9-3.7.13, 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2550350 CM-29830 | Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. | 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2550276 CM-29779 | In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. | 3.7.12-4.2.1 | 4.3.0 |
| 2550275 CM-29778 | If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2550244 CM-29760 | Several vulnerabilities were discovered in BIND, a DNS server implementation.bind9-host (containing only /usr/bin/host) and some libraries from the bind9 source package are installed on the switch by default; the BIND server referred to in these vulnerabilities is not installed by default but is available in the repository for optional installation.CVE-2019-6477: It was discovered that TCP-pipelined queries can bypass tcp-client limits resulting in denial of service. CVE-2020-8616: It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. CVE-2020-8617: It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service. Vulnerable: 9.11.5.P4+dfsg-5.1 Fixed: 9.11.5.P4+dfsg-5.1+deb10u1 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2550243 CM-29759 | When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
| 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2550117 CM-29691 | The following vulnerability has been announced in the apt package: CVE-2020-3810: Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files. Vulnerable: <= 1.8.2 Fixed: 1.8.2.1 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549925 CM-29594 | When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549894 CM-29576 | The Conntrack table fills up with OFFLOAD entries for flows that do not match the NAT rules in iptables. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549878 CM-29568 | When NAT is configured, non-NAT traffic is incorrectly forwarded to the CPU. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549859 CM-29556 | The following vulnerability has been announced that affects ntp: CVE-2020-11868: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. This affects: ntp-4.2.8p12 (possibly earlier) and ntp-4.2.8p13 The fix for https://bugs.ntp.org/3445 introduced a bug whereby a system that is running ntp-4.2.8p12 or p13 that only has one unauthenticated time source can be attacked in a way that causes the victim’s next poll to its source to be delayed, for as long as the attack is maintained. http://support.ntp.org/bin/view/Main/NtpBug3592 gives the following mitigations if it is not possible to upgrade to a version with the fix: * Use authentication with symmetric peers. * Have enough sources of time. The default NTP configuration in Cumulus Linux has four time sources. Fixed: 4.2.8p12+dfsg-4+cl4u13 | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2549838 CM-29546 | In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. | 3.7.12-4.2.1 | 4.3.0 |
| 2549784 CM-29520 | On Mellanox switches, when the networking service and switchd starts up, a rare condition might occur where switchd crashes and the following log message is generated:
| 4.1.0-4.2.1 | 4.3.0 |
| 2549782 CM-29519 | The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2549712 CM-29485 | The following vulnerability affects the openldap package: CVE-2020-12243: A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash). Vulnerable: <= 2.4.47+dfsg-3+deb10u1 Fixed: 2.4.47+dfsg-3+deb10u2 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549677 CM-29471 | After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549671 CM-29468 | On the Dell S4148T optical module, the low power polarity bit is set incorrectly and the switch port does not come up. To work around this issue, edit the /etc/hw_init.d/S10qsfp_init.sh file and change the lpmode line to be 0x3f instead of 0x00:
Reboot the switch and check that the switch port comes up. Important: Before upgrading Cumulus Linux 4.x with Debian packages that includes a fix for this problem, you must change the lpmode line back to 0x00. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549656 CM-29460 | The following security vulnerabilities affect qemu packages, which are available for optional installation on Cumulus Linux: CVE-2019-12068: In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances ’s->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. CVE-2019-15034: hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space. CVE-2019-20382: QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. Vulnerable: <= 3.1+dfsg-8+deb10u4 Fixed: 3.1+dfsg-8+deb10u5 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549577 CM-29420 | When you configure the management interface class (as shown below), eth0 remains in an admin down state on subsequent reboots:
| 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549511 CM-29385 | The following vulnerability affects the openssl package: CVE-2020-1967: Bernd Edlinger discovered that malformed data passed to the SSL_check_chain() function during or after a TLS 1.3 handshake could cause a NULL dereference, resulting in denial of service. Vulnerable: <= 1.1.1d-0+deb10u2 Fixed: 1.1.1d-0+deb10u3 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549472 CM-29367 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2549392 CM-29319 | When you configure an RD or RT with NCLU, you see duplicate VNI stanzas in the /etc/frr/frr.conf file.To work around this issue, manually edit the etc/frr/frr.conf file to define advertise-all-vni before the RD or RT configuration within the l2vpn EVPN address family, then reload the FRR service with the sudo systemctl reload frr command. | 4.1.0-4.3.0 | |
| 2549385 CM-29312 | FRR incorrectly orders advertise-all-vni to be later in the configuration than manual rd or route-target definitions. This causes the rd or route-target configuration to be misapplied or not applied at all.To work around this issue, when you manually configure the rd or route-target for a VNI, you must manually edit the /etc/frr/frr.conf file to define advertise-all-vni before the rd or route-target configuration within the l2vpn evpn address family. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549371 CM-29309 | When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2549347 CM-29296 | The following vulnerabilities have been announced in git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Vulnerable: <= 2.20.1-2+deb10u1 (CVE-2020-5260) <= 2.20.1-2+deb10u2 (CVE-2020-11008) Fixed: 2.20.1-2+deb10u3 | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2549307 CM-29284 | The following vulnerabilities affect git, which is available in the repository for optional installation: CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host. CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2549269 CM-29270 | On Mellanox switches with the Spectrum-2 ASIC, when you use more than 16 bonds on the switch, you might experience forwarding issues or see an error similar to the following in switchd.log:
To work around this issue, configure fewer than 16 bonds on a switch. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2549226 CM-29259 | You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. | 3.7.12-4.2.1 | 4.3.0 |
| 2548998 CM-29183 | On the Mellanox SN2010 and SN2100 switch, the fan speed might ramp up and down. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548988 CM-29178 | On Mellanox switches, the thermal monitoring script starts in suspended mode and, as a result, the fans run at sixty percent. You also see the following log message:
To work around this issue, run the following command to enable thermal monitoring:
| 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548962 CM-29165 | With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.3.0 |
| 2548933 CM-29151 | The following security vulnerability in the gnutls28 / libgnutls* packages has been announced for Cumulus Linux 4.x (Cumulus Linux 3.x is not vulnerable): CVE-2020-11501: GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 ‘\0’ bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol. Vulnerable: <= 3.6.7-4+deb10u2 Not vulnerable: 3.6.7-4+deb10u3 | 4.0.0-4.1.0 | 4.1.1-4.3.0 |
| 2548930 CM-29148 | On MLX switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0 |
| 2548920 CM-29145 | If you try to remove BFD configuration with a reload, the FRR service fails. The reload action results in a TypeError: expected string or bytes-like object error.You see this issue only if there is default configuration, such as configuration in the /etc/frr/frr.conf file that is suppressed from view in the FRR running configuration.To work around this issue, remove the default configuration lines; for example:
| 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548892 CM-29131 | NTP does not start when you use the default VRF instead of the management VRF. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548855 CM-29111 | Due to a packaging error, all switches installed from the same Cumulus Linux image have the same SSH host keys. This affects switches originally installed with Cumulus Linux 4.0.0 and 4.1.0 from a disk image only (including those that were upgraded by apt to a later release).As a result, this issue allows an attacker to more easily bypass remote host verification when a user connects by SSH to what is believed to be a previously used remote host but is really the attacker’s host. For example, this issue can be exploited by a spoofing or man-in-the-middle attack. To resolve this issue, generate new SSH host keys for any switch that has Cumulus Linux 4.0.0 or 4.1.0 installed on it:
After generating new SSH host keys, SSH clients that have previously logged into that switch will see a warning that the switch’s SSH host key changed; this is expected behavior. Be sure to inform anyone who may log in to the switch that you generated new SSH host keys. These users must log in to the affected switches with their SSH clients, where they will be given instructions on how to remove the old SSH host keys from the known hosts files to avoid a spoofing or man-in-the-middle attack directed at their SSH clients. *Notes* * This issue is fixed in Cumulus Linux 4.1.1. However, we recommend you generate new SSH host keys as this is the most reliable solution. * If you upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later using apt-get and you didn’t generate new SSH host keys, you will need to generate new SSH host keys after the upgrade.* If you perform a fresh install of Cumulus Linux 4.1.1 or later using a disk image, you will lose your existing local configuration. | 4.0.0-4.1.0 | 4.1.1-4.3.0, 4.2.0-4.3.0 |
| 2548746 CM-29068 | On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548710 CM-29057 | The following vulnerability was reported in the bluez package. No bluez packages are installed by default on Cumulus Linux 4.x, but libbluetooth3 is available from the repository for optional installation. CVE-2020-0556: It was reported that the BlueZ’s HID and HOGP profile implementations don’t specifically require bonding between the device and the host. Malicious devices can take advantage of this flaw to connect to a target host and impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source. | 4.0.0-4.1.0 | 4.1.1-4.3.0 |
| 2548674 CM-29044 | A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548672 CM-29043 | When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. | 3.7.12-4.2.1 | 4.3.0 |
| 2548657 CM-29035 | When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. | 3.7.12-4.2.1 | 4.3.0 |
| 2548655 CM-29033 | When using apt-get update && apt-get upgrade to upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later, a message similar to the following may appear.
To work around this issue and proceed with the upgrade, run apt-get update –allow-releaseinfo-change. | 4.0.0-4.1.0 | 4.1.1-4.3.0 |
| 2548595 CM-29000 | The net show config and net show time ntp server commands do not show NTP server configuration. | 4.1.0-4.2.0 | 4.2.1-4.3.0 |
| 2548586 CM-28995 | After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. | 3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548579 CM-28992 | The following security vulnerability has been announced: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 3.7.12, 4.0.0-4.1.0 | 3.7.13-3.7.14, 4.1.1-4.3.0 |
| 2548561 CM-28982 | On the EdgeCore Minipack-AS8000, when you try to configure ROCEv2, you see errors indicating that PFC is not working properly. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548496 CM-28948 | Cumulus Linux supports a maximum of 300 ACLs for use with 802.1X interfaces. This limit encompasses the default ACLs, pre-auth ACLs and dynamic ACLs. Exceeding this limit can affect the performance of the switch. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548490 CM-28944 | A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2548485 CM-28940 | If you configure aggregate-addresssummary-only before a component of the same aggregate is injected into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
To work around this issue, remove, then re-add the component prefix routes. | 3.7.12-4.2.1 | 4.3.0 |
| 2548457 CM-28925 | The global MTU setting in the mtu.json file does not take effect on SVI interfaces after ifreload -a.To work around this issue, run sudo systemctl restart networking or restart the switch.Note: A network restart is a disruptive operation. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548422 CM-28900 | You might see a core file in FRRouting related to OSPFv3 if the switch is configured as both an OSPFv3 ABR and ASBR, and other switches in the same area are also configured as both ABR and ASBR. This issue is not seen with a single ABR or ASBR in an area or if there are multiple ASBRs in an area not acting as ABRs. To work around this issue, do not perform redistribution on more than one ABR in the same area. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548408 CM-28891 | net show configuration commands does not show the RoCE net add interface configuration. | 4.1.0-4.2.1 | 4.3.0 |
| 2548383 CM-28867 | The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548373 CM-28862 | On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548320 CM-28821 | When configuring VRF route leaking, if you define import vrf route-map but do not have any imported VRFs, the route map command displays incorrectly, and as a result, FRR fails to reload. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2548315 CM-28816 | The following security advisory has been announced for bash: CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.To work around this issue, do not make bash or bash scripts setuid. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548310 CM-28812 | When the system boots, we might see " cumulus systemd-udevd[7566]: Process ‘/usr/bin/hw-management-thermal-events.sh add thermal_zone /sys /devices/virtual/thermal/thermal_zone25 thermal_zone25’ failed with exit code 1" errors. These errors are result of user space acting on kernel events a bit slow. The mlxsw_minimal driver is added during kernel boot; An SDK reset causes the driver to be deleted and re-instantiated; User space handler for thermal zone add sees the add first; But the underlying device is deleted before it can act on it. This situation is rectified as the mlxsw_minimal driver is re-instantiated later; | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548308 CM-28810 | When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. | 3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548275 CM-28781 | On the QuantaMesh BMS T5032-LY6 switch, when you run the hwclock command, you might see the error hwclock: select() to /dev/rtc0 to wait for clock tick timed out. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548260 CM-28770 | The net add routing route-map command does not add the set statement into the /etc/frr/frr.conf file. | 4.0.0-4.3.0 | |
| 2548243 CM-28754 | On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2548242 CM-28753 | On the Mellanox SN3800 switch, when you run sudo -E apt-get update, then sudo -E apt get upgrade, you see a dialog prompting you for the interface on which to run DHCP, followed by a request for DHCP relay options. You can ignore this dialog and press enter to continue with the upgrade. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548197 CM-28717 | On the Mellanox SN3800 switch, when you remove the PSU, smonctl reports that the PSU is BAD instead of ABSENT. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548194 CM-28714 | On the Mellanox SN3800 switch, when you remove a fan tray, smonctl reports that the fan is LOW instead of ABSENT. | 4.1.0-4.1.1 | 4.2.0-4.3.0 |
| 2548181 CM-28705 | On the Mellanox SN3800 switch, 4x25G DAC breakouts are not supported. | 4.1.0-4.3.0 | |
| 2548152 CM-28682 | On the Mellanox Spectrum switch in an EVPN symmetric configuration with MLAG, simultaneously shutting down the layer 3 interfaces that serve as uplinks to the VXLAN fabric might result in traffic loss of up to 15 seconds. | 4.1.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2548117 CM-28659 | In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2548113 CM-28656 | In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2548062 CM-28622 | When ports are split to 4x25G, RS FEC needs to explicitly configured on both ends (especially when interoperating with non-Mellanox switches). | 4.1.0-4.3.0 | |
| 2548060 CM-28620 | On the Mellanox SN3800 switch, links do not come up when the ports are configured for 40G. | 4.1.0-4.3.0 | |
| 2548024 CM-28596 | On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547890 CM-28497 | QinQ across VXLAN on a traditional bridge does not work. | 4.1.0-4.3.0 | |
| 2547881 CM-28489 | The following CVEs were announced for rsyslog: CVE-2019-17041 CVE-2019-17042 rsyslogd, when receiving remote log messages (not enabled by default on Cumulus Linux) with the pmaisforwardedfrom or pmcisconames optional log parsers (also not enabled by default on Cumulus Linux), is vulnerable to CVE-2019-17041 and CVE-2019-17042 where malicious messages that appear to be from AIX or Cisco respectively may be caused to skip sanity checks, resulting in incorrect negative lengths causing heap overflows. Vulnerable: 8.1901.0-1 Recommendation: Do not enable receiving syslog messages from other hosts by the network (with $UDPServerRun or $InputTCPServerRun). Also, do not enable (with $ModLoad) the vulnerable parsers pmaixforwardedfrom or pmcisconames. The default /etc/rsyslog.conf file on Cumulus Linux does not enable any of these. | 4.0.0-4.3.0 | |
| 2547839 CM-28465 | When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547784 CM-28442 | PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547782 CM-28441 | If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547706 CM-28397 | When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.To work around this issue, reboot the switch. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2547667 CM-28376 | On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547610 CM-28340 | Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. | 3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2547405 CM-28226 | When you restart the hsflowd service, you see a systemd warning message similar to the following:
| 4.0.0-4.3.0 | |
| 2547341 CM-28189 | When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
| 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547246 CM-28136 | The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
| 3.7.10-3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2547123 CM-28078 | On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2547100 CM-28061 | On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546991 CM-28003 | The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546985 CM-27999 | On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.14, 4.2.1-4.3.0 |
| 2546951 CM-27982 | switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). | 3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2546895 CM-27957 | If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service.To increase the systemd timeout:# Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter.# Restart the switchd service with the sudo systemctl restart switchd.service command.systemd will attempt to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. | 3.7.11-3.7.14.2, 4.0.0-4.3.0 | |
| 2546874 CM-27950 | On the Dell S5232F, S5248F, S5296F, and S3048 switch, using the poweroff or halt commands does not fully power off the switch. | 4.0.0-4.3.0 | |
| 2546485 CM-27753 | The EdgeCore Minipack-AS8000 switch supports FEC RS by default; you cannot disable this setting. However, the ethtool –show-fec command output indicates that FEC is disabled. Also, if you try to change the FEC setting, Cumulus Linux reports an error. For example:
| 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546337 CM-27678 | The net show bridge macs command returns an empty interface column.To work around this issue, run the bridge fdb show command to show the interface. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546261 CM-27642 | The following CVEs were announced that affect the libssh package: CVE-2019-14889 has been announced in the libssh library, where unsanitized user-provided scp command lines could allow an attacker to execute arbitrary commands on the server. The libssh library is not installed on Cumulus Linux by default, but is available in the Cumulus Linux 4 repository for optional installation. Note that libssh is distinct from libssh2 and openssh, which are present on the switches and in the repositories. See the following for more information: https://www.libssh.org/security/advisories/CVE-2019-14889.txt https://security-tracker.debian.org/tracker/CVE-2019-14889 | 4.0.0-4.3.0 | |
| 2546255 CM-27637 | On the EdgeCore Minipack-AS8000 switch, a 100G DAC link does not come up when auto-negotiation is enabled on the neighbor. This switch does not support 100G DAC auto-negotiation at this time. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2546225 CM-27627 | When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2546131 CM-27581 | On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. | 3.7.11-4.1.1 | 4.2.0-4.3.0 |
| 2545934 CM-27489 | Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. | 3.7.13, 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2545837 CM-27444 | If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. | 3.7.10-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2545537 CM-27254 | On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2545520 CM-27243 | The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2545352 CM-27136 | With a high number of active routes (20K or more), when you perform a networking restart, the FRR log files might become flooded with error messages associated with the restart. These logs are normal and are not directly a problem. However, the large number of messages can cause the logs to rotate away any previous history, which prevents you from tracing back events leading up to the restart. In a troubleshooting environment, this can be problematic. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2545239 CM-27099 | On the Mellanox switch with the Spectrum-2 ASIC, Precision Time Protocol (PTP) is not currently supported. | 4.0.0-4.3.0 | |
| 2545233 CM-27094 | On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. | 4.0.0-4.3.0 | |
| 2545164 CM-27049 | On the Mellanox switch with the Spectrum 2 ASIC, interfaces using 100G or 200G Direct Attach Cables (DACs) do not come up with the interface default configuration. To work around this issue and bring the interfaces up, perform the following configuration on both sides of the link: * Set the interface speed to the desired speed * Set link auto-negotiation to _off_ * Set link FEC to RS mode | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2545125 CM-27018 | If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2545012 CM-26942 | Port security is not currently supported on VX. The NCLU commands produce errors. | 4.0.0-4.3.0 | |
| 2544978 CM-26921 | If you delete an undefined bond, then add a bond slave, the net commit command fails. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544968 CM-26913 | FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544957 CM-26907 | NCLU incorrectly allows you to apply port security configuration on layer 2 and layer 3 ports that are not part of a bridge. | 4.0.0-4.3.0 | |
| 2544953 CM-26905 | When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. | 3.7.10-3.7.14.2, 4.0.0-4.3.0 | |
| 2544904 CM-26875 | After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544880 CM-26860 | When you run the NCLU net show commit last or net show commit command, where | 4.0.0-4.3.0 | |
| 2544856 CM-26841 | In the ethool -m output, the Revision Compliance field might show Unallocated when the SFF-8363 Revision Compliance value is SFF-8636 version 2.8 or later. | 4.0.0-4.1.1 | 4.2.0-4.3.0 |
| 2544723 CM-26769 | Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2544556 CM-26655 | If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. | 3.7.9-4.1.1 | 4.2.0-4.3.0 |
| 2544463 CM-26599 | Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544456 CM-26595 | The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2544311 CM-26516 | Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544155 CM-26423 | NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2544113 CM-26412 | Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. | 3.7.9-3.7.14.2, 4.0.0-4.3.0 | |
| 2543937 CM-26308 | An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. | 3.7.8-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543900 CM-26288 | On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543841 CM-26256 | The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | |
| 2543816 CM-26241 | On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. | 3.7.6-3.7.11, 4.0.0-4.3.0 | 3.7.12-3.7.14 |
| 2543781 CM-26217 | NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543724 CM-26179 | If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
| 3.7.7-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2543668 CM-26147 | On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo.To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
| 3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.14, 4.2.0-4.3.0 |
| 2543649 CM-26138 | You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
| 3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.14, 4.2.0-4.3.0 |
| 2543647 CM-26137 | ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
| 3.7.6-4.2.1 | 4.3.0 |
| 2543646 CM-26136 | In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2543401 CM-25986 | On the Mellanox Spectrum-2 switch, the time required to establish a link (from the time a link is set to admin up until the link becomes operationally up) can take up to 15 seconds on 40G interfaces and up to 30 seconds on 100G interfaces.To work around this issue, wait up to 15 seconds on 40G interfaces and 30 seconds on 100G interfaces for the link to establish. | 4.0.0-4.2.1 | 4.3.0 |
| 2543270 CM-25923 | The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. | 3.7.8-4.1.1 | 4.2.0-4.3.0 |
| 2543211 CM-25890 | In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2543164 CM-25859 | The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. | 3.7.7-3.7.14.2, 4.0.0-4.3.0 | |
| 2543096 CM-25815 | When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542979 CM-25766 | On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. | 3.7.7-4.1.1 | 4.2.0-4.3.0 |
| 2542945 CM-25740 | On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
| 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542837 CM-25674 | On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.3.0 | 3.7.9-3.7.14 |
| 2542305 CM-25400 | If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. | 3.7.6-3.7.14.2, 4.0.0-4.3.0 | |
| 2542301 CM-25397 | When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2541212 CM-24894 | The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2541029 CM-24799 | On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540950 CM-24751 | On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. | 3.7.3-4.1.1 | 4.2.0-4.3.0 |
| 2540808 CM-24652 | In an EVPN environment, the centralized MAC address is not installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN. This issue does not affect a pure distributed routing (symmetric or asymmetric) environment or a pure centralized routing environment. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2540753 CM-24618 | If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
| 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540444 CM-24473 | SNMP incorrectly requires engine ID specification. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540352 CM-24435 | When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2540340 CM-24426 | NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540274 CM-24379 | On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.14.2, 4.0.0-4.3.0 | |
| 2540204 CM-24350 | When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540192 CM-24343 | The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. | 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540155 CM-24332 | On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2540042 CM-24272 | When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540041 CM-24271 | On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540040 CM-24270 | Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
| 3.7.4-3.7.14.2, 4.0.0-4.3.0 | |
| 2540031 CM-24262 | NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. | 3.7.3-3.7.14.2, 4.0.0-4.3.0 | |
| 2539994 CM-24241 | When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
| 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539962 CM-24222 | When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2539670 CM-24035 | On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2539124 CM-23825 | The net add interface command adds no ptm-enable for that interface in the frr.conf file.Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538790 CM-23665 | NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.To restore connectivity, remove the VLAN ID from the bridge. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538590 CM-23584 | When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538562 CM-23570 | On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. | 3.7.2-3.7.14.2, 4.0.0-4.3.0 | |
| 2538294 CM-23417 | If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2537699 CM-23075 | There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. | 3.7.1-3.7.14.2, 4.0.0-4.3.0 | |
| 2537544 CM-23021 | When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. | 3.7.1-4.2.1 | 4.3.0 |
| 2536576 CM-22554 | If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. | 4.0.0-4.3.0 | |
| 2536384 CM-22386 | The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2536256 CM-22301 | For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets.
These packets are now policed by catch all rules. To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100. | 4.0.0-4.3.0 | |
| 2536242 CM-22287 | On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. | 4.0.0-4.3.0 | |
| 2536179 CM-22228 | On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535986 CM-22041 | At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535965 CM-22020 | On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. | 3.7.0-3.7.14.2, 4.0.0-4.3.0 | |
| 2535723 CM-21785 | The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. | 4.0.0-4.3.0 | |
| 2535707 CM-21769 | On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 4.0.0-4.1.1 | 3.7.14, 4.2.0-4.3.0 |
| 2535605 CM-21667 | FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.To work around this issue, add ttl-security to individual neighbors instead of the peer group. | 4.0.0-4.3.0 | |
| 2535209 CM-21278 | The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. | 3.7.5-3.7.10, 4.0.0-4.3.0 | 3.7.11-3.7.14 |
| 2534978 CM-21055 | On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 4.0.0-4.2.1 | 3.7.14, 4.3.0 |
| 2534734 CM-20813 | Span rules matching the out-interface as a bond do not mirror packets. | 4.0.0-4.3.0 | |
| 2533691 CM-19788 | If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. | 3.7.12-3.7.14.2, 4.0.0-4.3.0 | |
| 2533625 CM-19724 | PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. | 4.0.0-4.3.0 | |
| 2533337 CM-19454 | When you use NCLU to bring a bond admin down (net add bond ), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.To work around this issue, use the sudo ifdown command. | 4.0.0-4.3.0 | |
| 2531273 CM-17494 | In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet. To work around this issue, change the value of arp_ignore to 2. See [Address Resolution Protocol in the Cumulus Linux user guide|https://docs.cumulusnetworks.com/cumulus-linux/Layer-3/Address-Resolution-Protocol-ARP/] for more information. | 4.0.0-4.3.0 |
Fixed Issues in 4.1.0
| Issue ID | Description | Affects |
|---|---|---|
| 2548434 CM-28909 | On the Mellanox SN3800 switch, 10x4G, 10G, and 4x25G are all currently unsupported. | |
| 2548324 CM-28825 | hostapd is not installed in Cumulus Linux 4.0.0 by default.To work around this issue, run the following commands to install the package:
| 4.0.0-4.0.1 |
| 2548289 CM-28794 | When the NETQ agent is active, you see the following errors in in the FFR log file:
You also see the following errors in the ptmd log file:
You can ignore these errors. | 4.0.0-4.0.1 |
| 2548116 CM-28658 | The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12, 4.0.0-4.0.1 |
| 2548111 CM-28655 | When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2548045 CM-28609 | On the Delta AG9032v1 switch, swp5 does not link up using 100G SR4 modules. To work around this issue, use a different port for 100G SR4 modules. | |
| 2547942 CM-28533 | On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 |
| 2547911 CM-28510 | The following vulnerabilities were discovered in cURL, an URL transfer library. CVE-2019-5481: Thomas Vegas discovered a double-free in the FTP-KRB code, triggered by a malicious server sending a very large data block. CVE-2019-5482: Thomas Vegas discovered a heap buffer overflow that could be triggered when a small non-default TFTP blocksize is used. Vulnerable: 7.64.0-4 Fixed: 7.64.0-4+deb10u1 | 4.0.0-4.0.1 |
| 2547799 CM-28451 | An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. | 3.7.11-3.7.13, 4.0.0-4.0.1 |
| 2547663 CM-28374 | When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 |
| 2547659 CM-28372 | On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 |
| 2547592 CM-28331 | When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 |
| 2547558 CM-28313 | On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. | 3.7.11, 4.0.0-4.0.1 |
| 2547509 CM-28276 | When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2547443 CM-28248 | On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 |
| 2547399 CM-28221 | The following security vulnerabilities have been announced in qemu, which is not installed by default on Cumulus Linux but is available in the repository for optional installation: CVE-2019-15890 CVE-2020-7039 CVE-2020-1711: security issues have been found in the SLiRP networking implementation of QEMU, a fast processor emulator, which could result in the execution of arbitrary code or denial of service. https://security-tracker.debian.org/tracker/source-package/qemu Vulnerable: <= 3.1+dfsg-8+deb10u3 Fixed: 3.1+dfsg-8+deb10u4 | 4.0.0-4.0.1 |
| 2547396 CM-28218 | The following security vulnerability affects libidn2, which is installed by default on Cumulus Linux: CVE-2019-18224: A heap-based buffer overflow vulnerability was discovered in the idn2_to_ascii_4i() function in libidn2, the GNU library for Internationalized Domain Names (IDNs), which could result in denial of service, or the execution of arbitrary code when processing a long domain string. For more information, see: https://security-tracker.debian.org/tracker/libidn2 https://security-tracker.debian.org/tracker/CVE-2019-18224 Vulnerable: 2.0.5-1 Fixed: 2.0.5-1+deb10u1 | 4.0.0-4.0.1 |
| 2547360 CM-28200 | The Mellanox SN3700C switch experiences a kernel memory leak in the bridge IPv4 multicast receive function. When IGMP snooping is disabled, received IGMP packets are cloned and the clone is not freed, causing a memory leak. Because this memory leak is in the kernel, you cannot clear it by restarting a service; you must reboot the switch to clear the allocated memory. | 4.0.0-4.0.1 |
| 2547303 CM-28169 | On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11, 4.0.0-4.0.1 |
| 2547293 CM-28160 | On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2547286 CM-28156 | NCLU crashes when you run the net add interface storage-optimized pfc command because non-ASCII quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ASCII single quotes with ASCII single quotes (standard single quote on the keyboard). | 4.0.0-4.0.1 |
| 2547266 CM-28150 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. | 4.0.0-4.0.1 |
| 2547205 CM-28119 | On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:
To work around this issue, run the net show system sensors json command instead. | 4.0.0-4.0.1 |
| 2547154 CM-28090 | Two security issues were found in the Python interface to the apt package manager, which is installed by default on Cumulus Linux; package downloads from unsigned repositories were incorrectly rejected (CVE-2019-15796) and the hash validation relied on MD5 (CVE-2019-15795). For more information, see https://security-tracker.debian.org/tracker/source-package/python-apt Vulnerable: 1.8.4 Fixed: 1.8.4.1 | 4.0.0-4.0.1 |
| 2547149 CM-28087 | The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11, 4.0.0-4.0.1 |
| 2547147 CM-28086 | The ospfd daemon might crash with the following kernel trace:
| 3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2547128 CM-28081 | The cumulus-overrides package contains the /etc/apt/preferences.d/20_prefer_cumulus file that pins packages from specific release names. The pinning file contains the wrong name.To work around this issue, use the origin instead of the release name. | 4.0.0-4.0.1 |
| 2547122 CM-28077 | An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2547118 CM-28074 | The following security vulnerabilities have been announced in the libtiff5 library on Cumulus Linux 4.0: CVE-2019-14973, CVE-2019-17546: Multiple integer overflows have been discovered in the libtiff library and the included tools. Vulnerable: 4.0.10-4 Fixed: 4.1.0+git191117-2~deb10u1 | 3.7.10, 4.0.0-4.0.1 |
| 2547071 CM-28048 | On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11, 4.0.0-4.0.1 |
| 2547043 CM-28038 | After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. | 3.7.11, 4.0.0-4.0.1 |
| 2547013 CM-28016 | On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. | 3.7.7-3.7.11, 4.0.0-4.0.1 |
| 2546999 CM-28007 | When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 |
| 2546988 CM-28000 | The following security advisory has been announced for the libxen packages, which are not installed by default in Cumulus Linux but are available in the repository for installation: Debian Security Advisory DSA-4602-1 CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. In addition this update provides mitigations for the “TSX Asynchronous Abort” speculative side channel attack. For additional information, refer to https://xenbits.xen.org/xsa/advisory-305.html For more information, see https://security-tracker.debian.org/tracker/xen . Fixed version: 4.11.3+24-g14b62ab3e5-1~deb10u1. | 4.0.0-4.0.1 |
| 2546979 CM-27995 | When enabled on an egress interface, SPAN does not work. | |
| 2546869 CM-27947 | Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. | 3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546739 CM-27875 | The Mellanox SN3700C switch does not forward LLDP or LACP traffic. | 4.0.0-4.0.1 |
| 2546703 CM-27855 | The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. | 3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546577 CM-27814 | A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2546559 CM-27801 | On the Mellanox SN3700C switch, if you try to break out 100G switch ports into 2x50G, the configuration fails and switchd does not restart. Breaking out the ports into 4x25G works without issue. | 4.0.0-4.0.1 |
| 2546542 CM-27793 | A security vulnerability has been announced in the cyrus-sasl2 (libsasl2-2 and libsasl2-modules) package. The libraries are installed by default on Cumulus Linux. CVE-2019-19906: Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library. Vulnerable: 2.1.27+dfsg-1 Fixed: 2.1.27+dfsg-1+deb10u1 | 3.7.11-4.0.1 |
| 2546502 CM-27764 | On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 |
| 2546454 CM-27740 | When you run the NCLU net del all command to delete all configuration on the switch, you see an error similar to the following:
| 4.0.0-4.0.1 |
| 2546423 CM-27719 | Several vulnerabilities have been discovered in the interpreter for the Ruby language, which could result in unauthorized access by bypassing intended path matchings, denial of service, or the execution of arbitrary code. These vulnerabilities affect the ruby2.5 package that is available for optional installation in Cumulus Linux 4.x, but is not installed by default. CVE-2019-15845: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. CVE-2019-16201: WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network. CVE-2019-16254: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. CVE-2019-16255: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the “command” argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. Vulnerable: 2.5.5-3 | 4.0.0-4.0.1 |
| 2546389 CM-27699 | In a default VX instance, a ping to a device’s hostname fails. To work around this issue, edit the /etc/gai.conf file and uncomment precedence ::ffff:0:0/96 10. | 4.0.0-4.0.1 |
| 2546329 CM-27670 | A memory leak in switchd might occur, which causes switchd to restart. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546266 CM-27645 | Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system, which is installed by default on Cumulus Linux 4.x. CVE-2019-1348: export-marks is insecure, fix is to disable by default. CVE-2019-1349: .git / git~1 filename vulnerability on NTFS CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses CVE-2019-1353: NTFS filesystem protection should be on by default CVE-2019-1387: dubiously-nested submodule git directories should be disallowed CVE-2019-19604: submodule update repository code execution vulnerability Vulnerable: <= 2.20.1-2 Fixed: 2.20.1-2+deb10u1 | 4.0.0-4.0.1 |
| 2546265 CM-27644 | Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546201 CM-27619 | The following security vulnerabilities have been announced in the nss/libnss3 library, which is not installed by default but is available in the repository: CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS See https://security-tracker.debian.org/tracker/source-package/nss for more information. Vulnerable: <= 3.42.1-1+deb10u1 | 4.0.0-4.0.1 |
| 2546141 CM-27586 | CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. | 3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2546061 CM-27547 | Trident2+ switches do not enable DFE for 10G and 4x10G DACs. As a result, longer or marginal 10G DACs might not link up reliably. To work around this issue, run the following command after a reboot. On the SFP side:
On the QSFP side:
| 4.0.0-4.0.1 |
| 2545988 CM-27517 | When hsflowd is used on the switch, you might experience a kernel panic. | 4.0.0-4.0.1 |
| 2545972 CM-27507 | The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. | 3.7.10-3.7.11 |
| 2545949 CM-27496 | All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. | 3.7.11, 4.0.0-4.0.1 |
| 2545868 CM-27457 | If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545866 CM-27456 | After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545851 CM-27454 | The Mellanox minimal platform module driver probe does not handle error conditions correctly. To work around this issue, power cycle the switch. | 4.0.0-4.0.1 |
| 2545724 CM-27367 | On the Mellanox switch with the Spectrum or Spectrum-2 ASIC, switchd might crash, then restart under certain conditions. | 4.0.0-4.0.1 |
| 2545699 CM-27354 | On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. | 3.7.10-3.7.13 |
| 2545694 CM-27351 | On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 |
| 2545608 CM-27299 | The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545600 CM-27295 | IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
| 3.7.2-3.7.11, 4.0.0-4.0.1 |
| 2545570 CM-27275 | CVE-2018-12207: Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. Running hypervisors for virtual guest operating systems is not supported on Cumulus Linux. Additionally, an affected package qemu is not included in the image, although it is available on upstream repo mirrors. | 4.0.0-4.0.1 |
| 2545566 CM-27272 | The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 |
| 2545501 CM-27229 | On a traditional bridge, VLAN tagged traffic is not discarded when it exceeds the port security MAC limit. | 4.0.0-4.0.1 |
| 2545448 CM-27193 | The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. | 3.7.10, 4.0.0-4.0.1 |
| 2545437 CM-27184 | With the port security feature, if you change the number of MAC addresses allowed to access a port with the NCLU net add interface command, the net show configuration commands command might fail. | 4.0.0-4.0.1 |
| 2545410 CM-27179 | On rare occasions on a Mellanox SN3700C switch, if you insert and remove, then reinsert an AOC or QSFP28 optical transceiver quickly, port #32 might get stuck. To avoid this issue, wait 15 seconds before insertion and before removal of the module. | 4.0.0-4.0.1 |
| 2545404 CM-27173 | On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2545314 CM-27118 | The Broadcom switch with the Tomahawk3 ASIC, such as the EdgeCore Minipack AS8000, might not learn all MAC address on a port configured for bridging when the hardware MAC table is near the maximum capacity. | 4.0.0-4.0.1 |
| 2545236 CM-27096 | On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545133 CM-27025 | On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. | 3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545087 CM-26996 | On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. | 3.7.10, 4.0.0-4.0.1 |
| 2545049 CM-26968 | When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545040 CM-26961 | On the Mellanox switch, error messages with hw-management-thermal-events.sh are displayed on shutdown. | 4.0.0-4.0.1 |
| 2544854 CM-26839 | On the Dell S5248F-ON switch, CPU core temp sensors may show as ABSENT. | 4.0.0-4.0.1 |
| 2544847 CM-26838 | You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. | 3.7.7-3.7.10, 4.0.0-4.0.1 |
| 2544625 CM-26703 | VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2544329 CM-26525 | When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:
| 4.0.0-4.0.1 |
| 2544213 CM-26450 | Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2544200 CM-26448 | Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2543792 CM-26225 | On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
| 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2543750 CM-26200 | The following CVEs were announced that affect the systemd-resolved package. Cumulus Linux does not enable systemd-resolved by default, so Cumulus Linux is not vulnerable as shipped.CVE-2019-15718 Missing access controls on systemd-resolved’s D-Bus interface Source Package Release Version Status: buster 241-7 vulnerable For the detailed security status, refer to the security tracker page at: https://security-tracker.debian.org/tracker/CVE-2019-15718 | 4.0.0-4.0.1 |
| 2543690 CM-26158 | On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 |
| 2543472 CM-26024 | On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. | 3.7.7-3.7.12, 4.0.0-4.0.1 |
| 2542872 CM-25693 | After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2542824 CM-25665 | On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) | 3.7.5-3.7.11, 4.0.0-4.0.1 |
| 2542767 CM-25641 | If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.To work around this issue, power cycle the switch. | 3.7.6-3.7.12, 4.0.0-4.0.1 |
| 2542510 CM-25505 | In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
| 3.7.6-3.7.10, 4.0.0-4.0.1 |
| 2541428 CM-24993 | When you try to change the NTP time zone with the NCLU net add time zone command or by editing the /etc/timezone file manually, the configuration does not take effect.To work around this issue, change the time zone with the sudo timedatectl set-timezone command. For example:
| 4.0.0-4.0.1 |
| 2538256 CM-23397 | On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. | 3.7.2-4.0.1 |
| 2537061 CM-22794 | The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. | 3.7.1-4.0.1 |
| 2536617 CM-22591 | CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs. To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:
| 3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2536231 CM-22277 | On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2535845 CM-21898 | On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. | 4.0.0-4.0.1 |
| 2532593 CM-18727 | On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | |
| 2532017 CM-18192 | In FRR, bgp_snmp does not show all BGP peers when peer groups used. | 3.7.11-4.0.1 |