flatcar/scripts stable-3510.2.0

on GitHub

Changes since Stable 3374.2.5

Security fixes:

• Linux (CVE-2022-2196, CVE-2022-27672, CVE-2022-3707, CVE-2023-1078, CVE-2023-1281, CVE-2023-1513, CVE-2023-26545)
• bind tools (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)
• binutils (CVE-2022-38126, CVE-2022-38127)
• containerd (CVE-2022-23471)
• cpio (CVE-2021-38185)
• curl (CVE-2022-35252, CVE-2022-43551, CVE-2022-43552,CVE-2022-32221, CVE-2022-35260, CVE-2022-42915, CVE-2022-42916)
• dbus (CVE-2022-42010, CVE-2022-42011, CVE-2022-42012)
• git (CVE-2022-39253, CVE-2022-39260, CVE-2022-23521, CVE-2022-41903)
• glib (fixes to normal form handling in GVariant)
• Go (CVE-2022-41717)
• libarchive (CVE-2022-36227)
• libksba (CVE-2022-47629, CVE-2022-3515)
• libxml2 (CVE-2022-40303, CVE-2022-40304)
• logrotate (CVE-2022-1348)
• multipath-tools (CVE-2022-41973, CVE-2022-41974)
• sudo (CVE-2023-22809, CVE-2022-43995)
• systemd (CVE-2022-3821, CVE-2022-4415)
• vim (CVE-2023-0049, CVE-2023-0051, CVE-2023-0054, CVE-2022-3705, CVE-2022-3491, CVE-2022-3520, CVE-2022-3591, CVE-2022-4141, CVE-2022-4292, CVE-2022-4293,CVE-2022-1725, CVE-2022-3234, CVE-2022-3235, CVE-2022-3278, CVE-2022-3256, CVE-2022-3296, CVE-2022-3297, CVE-2022-3324, CVE-2022-3352, CVE-2022-2042, CVE-2022-2124, CVE-2022-2125, CVE-2022-2126, CVE-2022-2129, CVE-2022-2175, CVE-2022-2182, CVE-2022-2183, CVE-2022-2206, CVE-2022-2207, CVE-2022-2208, CVE-2022-2210, CVE-2022-2231, CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288, CVE-2022-2289, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2522, CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-2845, CVE-2022-2849, CVE-2022-2862, CVE-2022-2874, CVE-2022-2889, CVE-2022-2923, CVE-2022-2946, CVE-2022-2980, CVE-2022-2982, CVE-2022-3016, CVE-2022-3099, CVE-2022-3134, CVE-2022-3153)
• SDK: Python (CVE-2015-20107, CVE-2020-10735, CVE-2021-3654, CVE-2022-37454, CVE-2022-42919, CVE-2022-45061)
• SDK: qemu (CVE-2022-4172, CVE-2020-14394, CVE-2022-0216, CVE-2022-35414, CVE-2022-3872)
• SDK: rust (CVE-2022-46176, CVE-2022-36113, CVE-2022-36114)

Bug fixes:

• Added back Ignition support for Vagrant (coreos-overlay#2351)
• Added support for hardware security keys in update-ssh-keys (update-ssh-keys#7)
• Enabled IOMMU on arm64 kernels, the lack of which prevented some systems from booting (coreos-overlay#2235)
• Fixed a regression (in Alpha/Beta) where machines failed to boot if they didn't have the core user or group in /etc/passwd or /etc/group (baselayout#26)
• Fix "ext4 deadlock under heavy I/O load" kernel issue. The patch for this is included provisionally while we wait for it to be merged upstream (Flatcar#847, coreos-overlay#2315)
• Restored the support to specify OEM partition files in Ignition when /usr/share/oem is given as initrd mount point (bootengine#58)
• The rootfs setup in the initrd now runs systemd-tmpfiles on every boot, not only when Ignition runs, to fix a dbus failure due to missing files (Flatcar#944)

Changes:

• Added CONFIG_NF_CONNTRACK_BRIDGE (for nf_conntrack_bridge) and CONFIG_NFT_BRIDGE_META (for nft_meta_bridge) to the kernel config to allow using conntrack rules for bridges in nftables and to match on bridge interface names (coreos-overlay#2207)
• Added new image signing pub key to flatcar-install, needed for download verification of releases built from July 2023 onwards, if you have copies of flatcar-install or the image signing pub key, you need to update them as well (init#92)
• Change CONFIG_WIREGUARD kernel option to module to save space on boot partition (coreos-overlay#2239)
• Disable several arch specific arm64 kernel config options for unsupported platforms to save space on boot partition (coreos-overlay#2239)
• Specifying the OEM filesystem in Ignition to write files to /usr/share/oem is not needed anymore (bootengine#58)
• Switched from --strip-unneeded to --strip-debug when installing kernel modules, which makes kernel stacktraces more accurate and makes debugging issues easier (coreos-overlay#2196)
• The flatcar-update tool got two new flags to customize ports used on the host while updating flatcar (init#81)
• Toolbox now uses containerd to download and mount the image (toolbox#7)
• Add qemu-guest-agent to all amd64 images, it will be automatically enabled when qemu-ga virtio-port is detected (coreos-overlay#2240, portage-stable#373)

Updates:

• Linux (5.15.98 (includes 5.15.97, 5.15.96, 5.15.95, 5.15.94, 5.15.93))
• Linux Firmware (20230117)
• adcli (0.9.2)
• bind tools (9.16.36 (includes 9.16.34 and 9.16.35))
• binutils (2.39)
• bpftool (5.19.12)
• ca-certificates (3.89)
• containerd (1.6.16)
• cpio (2.13)
• curl (7.87.0 (includes 7.85))
• dbus (1.14.4)
• Docker (20.10.23)
• elfutils (0.188 (includes 0.187))
• Expat (2.5.0)
• gawk (5.2.1 (contains 5.2.0))
• gettext (0.21.1)
• git (2.39.1 (includes 2.39.0))
• glib (2.74.4)
• Go (1.19.5)
• glibc (2.36 (includes 2.35))
• GnuTLS (3.7.8)
• I2C tools (4.3)
• Intel Microcode (20221108)
• iptables (1.8.8)
• iputils (20211215)
• libcap (2.66)
• libcap-ng (0.8.3)
• libksba (1.6.3)
• libseccomp (2.5.4 (contains 2.5.2, 2.5.3))
• libxml2 (2.10.3)
• logrotate (3.20.1)
• MIT Kerberos V (1.20.1)
• multipath-tools (0.9.3)
• nettle (3.8.1)
• nmap (7.93)
• OpenSSH (9.1)
• rsync (3.2.7)
• shadow (4.13)
• sqlite (3.40.1 (contains 3.40.0 and 3.39.4))
• strace (5.19)
• sudo (1.9.12_p2)
• systemd (252.5 (includes 252))
• vim (9.0.1157 (includes 9.0.0469))
• wget (1.21.3)
• whois (5.5.14)
• wireguard-tools (1.0.20210914)
• XZ utils (5.4.1 (includes 5.4.0))
• zlib (1.2.13)
• OEM: python-oem (3.9.16)
• SDK: boost (1.81.0)
• SDK: catalyst (3.0.21)
• SDK: cmake (3.23.3)
• SDK: file (5.43 (includes 5.44))
• SDK: libpng (1.6.39 (includes 1.6.38))
• SDK: libxslt (1.1.37)
• SDK: meson (0.62.2)
• SDK: ninja (1.11.0)
• SDK: pahole (1.23)
• SDK: perl (5.36.0)
• SDK: portage (3.0.43 (includes 3.0.42, 3.0.41))
• SDK: qemu (7.2.0 (includes 7.1.0))
• SDK: Rust (1.67.0)
• VMware: open-vm-tools (12.1.5)

Changes since Beta 3510.1.0

Security fixes:

Bug fixes:

• Restored the support to specify OEM partition files in Ignition when /usr/share/oem is given as initrd mount point (bootengine#58)

Changes:

• Added new image signing pub key to flatcar-install, needed for download verification of releases built from July 2023 onwards, if you have copies of flatcar-install or the image signing pub key, you need to update them as well (init#92)
• Specifying the OEM filesystem in Ignition to write files to /usr/share/oem is not needed anymore (bootengine#58)

Updates:

• ca-certificates (3.89)