kinvolk/manifest v3139.1.0

on GitHub

New Beta Release 3139.1.0

Changes since Alpha 3139.0.0

Security fixes

• Linux (CVE-2022-0492, CVE-2022-0516, CVE-2022-0435, CVE-2022-0487, CVE-2022-25375, CVE-2022-25258, CVE-2022-0847)
• go (CVE-2022-23806, CVE-2022-23772, CVE-2022-23773)
• expat (CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25314, CVE-2022-25315)

Bug fixes

• Disabled the systemd-networkd settings ManageForeignRoutes and ManageForeignRoutingPolicyRules by default to ensure that CNIs like Cilium don't get their routes or routing policy rules discarded on network reconfiguration events (Flatcar#620).
• Prevented hitting races when creating filesystems in Ignition, these races caused boot failures like fsck[1343]: Failed to stat /dev/disk/by-label/ROOT: No such file or directory when creating a btrfs root filesystem (ignition#35)
• Reverted the Linux kernel change to forbid xfrm id 0 for IPSec state because it broke Cilium (Flatcar#626, coreos-overlay#1682)

Changes

• Added support for switching back to CGroupsV1 without requiring a reboot. Create /etc/flatcar-cgroupv1 through ignition. (coreos-overlay#1666)

Updates

• Linux (5.15.25) (from 5.15.19)
• ca-certificates (3.75)
• Go (1.17.7)
• expat (2.4.6)

Changes since Beta 3066.1.2

Security fixes

• GCC (CVE-2020-13844)
• Go (CVE-2021-44716, CVE-2021-44717, CVE-2022-23806, CVE-2022-23772, CVE-2022-23773)
• containerd (CVE-2021-43816)
• expat (CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25314, CVE-2022-25315)
• ignition (CVE-2020-14040, CVE-2021-38561)
• krb5 (CVE-2021-37750)
• libarchive (libarchive-1565, libarchive-1566)
• openssh (CVE-2021-41617)
• openssl (CVE-2021-4044)
• torcx (CVE-2021-38561, CVE-2021-43565)
• vim (CVE-2021-3872, CVE-2021-3875, CVE-2021-3903, CVE-2021-3927, CVE-2021-3928, CVE-2021-3968, CVE-2021-3973, CVE-2021-3974)
• SDK: edk2-ovmf (CVE-2019-14584, CVE-2021-28210, CVE-2021-28211, CVE-2021-28213)
• SDK: libxslt (CVE-2021-30560)
• SDK: mantle (CVE-2021-3121, CVE-2021-38561, CVE-2021-43565)
• SDK: Rust (CVE-2022-21658)
• SDK: QEMU (CVE-2020-35504, CVE-2020-35505, CVE-2020-35506, CVE-2020-35517, CVE-2021-20203, CVE-2021-20255, CVE-2021-20257, CVE-2021-20263, CVE-2021-3409, CVE-2021-3416, CVE-2021-3527, CVE-2021-3544, CVE-2021-3545, CVE-2021-3546, CVE-2021-3582, CVE-2021-3607, CVE-2021-3608, CVE-2021-3682)

Bug fixes

• Excluded the Kubenet cbr0 interface from networkd's DHCP config and set it to Unmanaged to prevent interference and ensure that it is not part of the network online check (init#55)
• Fixed the dracut emergency Ignition log printing that had a scripting error causing the cat command to fail (bootengine#33)
• network: Accept ICMPv6 Router Advertisements to fix IPv6 address assignment in the default DHCP setting (init#51, coreos-cloudinit#12, bootengine#30)
• flatcar-update: Stopped checking for the USER environment variable which may not be set in all environments, causing the script to fail unless a workaround was used like prepending an additional sudo invocation (init#58)
• Disabled the systemd-networkd settings ManageForeignRoutes and ManageForeignRoutingPolicyRules by default to ensure that CNIs like Cilium don't get their routes or routing policy rules discarded on network reconfiguration events (Flatcar#620).
• Prevented hitting races when creating filesystems in Ignition, these races caused boot failures like fsck[1343]: Failed to stat /dev/disk/by-label/ROOT: No such file or directory when creating a btrfs root filesystem (ignition#35)
• Reverted the Linux kernel change to forbid xfrm id 0 for IPSec state because it broke Cilium (Flatcar#626, coreos-overlay#1682)

Changes

• Update-engine now creates the /run/reboot-required flag file for kured (update_engine#15)
• Excluded special network interface devices like bridge, tunnel, vxlan, and veth devices from the default DHCP configuration to prevent networkd interference (init#56)
• Added CONFIG_NF_CT_NETLINK_HELPER (for libnetfilter_cthelper), CONFIG_NET_VRF (for virtual routing and forwarding) and CONFIG_KEY_DH_OPERATIONS (for keyutils) to the kernel config (coreos-overlay#1524)
• Enabled the FIPS support for the Linux kernel, which users can now choose through a kernel parameter in grub.cfg (check it taking effect with cat /proc/sys/crypto/fips_enabled) (coreos-overlay#1602)
• Added support for switching back to CGroupsV1 without requiring a reboot. Create /etc/flatcar-cgroupv1 through ignition. (coreos-overlay#1666)
• Removed the pre-shipped /etc/flatcar/update.conf file, leaving it totally to the user to define the contents as it was unnecessarily overwriting the /use/share/flatcar/update.conf (flatcar-linux/scripts#212)

Updates

• Linux (5.15.25) (from 5.10.96)
• GCC (9.4.0)
• Go (1.17.7)
• ca-certificates (3.75)
• systemd (249.7)
• acl (2.3.1)
• attr (2.5.1)
• audit (3.0.6)
• boost (1.76.0)
• btrfs-progs (5.15.1)
• coreutils (8.32)
• diffutils (3.8)
• ethtool (5.10)
• expat (2.4.6)
• findutils (4.8.0)
• glib (2.68.4)
• i2c-tools (4.2)
• iproute2 (5.15)
• ipset (7.11)
• ipvsadm (1.27)
• iputils (20210722)
• kmod (29)
• libarchive (3.5.2)
• libcap-ng (0.8.2)
• libseccomp (2.5.1)
• lshw (02.19.2b_p20210121)
• lsof (4.94.0)
• openssh (8.8)
• openssl (3.0.1)
• parted (3.4 (includes 3.3))
• pciutils (3.7.0)
• polkit (0.120)
• runc (1.1.0)
• sbsigntools (0.9.4)
• sed (4.8)
• usbutils (014)
• vim (8.2.3582)
• Azure: Python for OEM images (3.9.8)
• SDK: Linux headers (5.15)
• SDK: edk2-ovmf (202105)
• SDK: file (5.40)
• SDK: ipxe (1.21.1)
• SDK: mantle (0.18.0)
• SDK: perf (5.15)
• SDK: Python (3.9.8)
• SDK: Rust (1.58.1)
• SDK: QEMU (6.1.0)
• SDK: seabios (1.14.0)
• SDK: sgabios (0.1_pre10)