layout-3 layout-6 layout-1 layout-top
NVIDIA Docs Hubchevron_right NVIDIA Networkingchevron_right Networking Softwarechevron_right Switch Softwarechevron_right

Cumulus Linux

layout-top layout-6 layout-1

If you are using the current version of Cumulus Linux, the content on this page may not be up to date. The current version of the documentation is available here. If you are redirected to the main page of the user guide, then this page may have been renamed; please search for it there.

Cumulus Linux 4.0 Release Notes

Download 4.0 Release Notes xls    Download all 4.0 release notes as .xls

4.0.1 Release Notes

Open Issues in 4.0.1

Issue ID Description Affects Fixed
CM-27719
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which could result in unauthorized access by bypassing intended path matchings, denial of service, or the execution of arbitrary code.
These vulnerabilities affect the ruby2.5 package that is available for optional installation in Cumulus Linux 4.x, but is not installed by default.
CVE-2019-15845: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVE-2019-16201: WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVE-2019-16254: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients.
CVE-2019-16255: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the “command” argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Vulnerable: 2.5.5-3		 4.0.0-4.0.1
CM-27699
In a default VX instance, a ping to a device’s hostname fails.
To work around this issue, edit the /etc/gai.conf file and uncomment precedence ::ffff:0:0/96 10.		 4.0.0-4.0.1
CM-27678
The net show bridge macs command returns an empty interface column.
To work around this issue, run the bridge fdb show command to show the interface.		 4.0.0-4.0.1
CM-27645
Several vulnerabilities have been discovered in git, a fast, scalable,
distributed revision control system, which is installed by default on Cumulus Linux 4.x.
CVE-2019-1348: export-marks is insecure, fix is to disable by default.
CVE-2019-1349: .git / git~1 filename vulnerability on NTFS
CVE-2019-1352: .git vulnerability with NTFS Alternate Streams Accesses
CVE-2019-1353: NTFS filesystem protection should be on by default
CVE-2019-1387: dubiously-nested submodule git directories should be disallowed
CVE-2019-19604: submodule update repository code execution vulnerability
Vulnerable: <= 2.20.1-2		 4.0.0-4.0.1
CM-27642
The following CVEs were announced that affect the libssh package:
CVE-2019-14889 has been announced in the libssh library, where unsanitized user-provided scp command lines could allow an attacker to execute arbitrary commands on the server.
The libssh library is not installed on Cumulus Linux by default, but is available in the Cumulus Linux 4 repository for optional installation. Note that libssh is distinct from libssh2 and openssh, which are present on the switches and in the repositories.
See the following for more information:
https://www.libssh.org/security/advisories/CVE-2019-14889.txt
https://security-tracker.debian.org/tracker/CVE-2019-14889		 4.0.0-4.0.1
CM-27619
The following security vulnerabilities have been announced in the nss / libnss3 library, which is not installed by default but is available in the repository:
CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
CVE-2019-17007: nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS
See https://security-tracker.debian.org/tracker/source-package/nss for more information.
Vulnerable: <= 3.42.1-1+deb10u1		 4.0.0-4.0.1
CM-27422
The control plane ACL files uses variables that were not defined, which results in an error on boot.
Add the following two lines to the top of the file /etc/cumulus/acl/policy.d/00control_plane.rules:
BOOTPC_PORT = 67
BOOTPS_PORT = 68
 4.0.0-4.0.1
CM-27367
Under certain circumstances, switchd might crash, then restart, on Mellanox switches with the Spectrum or Spectrum-2 ASIC. 4.0.0-4.0.1
CM-27275
CVE-2018-12207: Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
Running hypervisors for virtual guest operating systems is not supported on Cumulus Linux. Additionally, an affected package qemu is not included in the image, although it is available on upstream repo mirrors.		 4.0.0-4.0.1
CM-27254
On Mellanox switches with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. 4.0.0-4.0.1
CM-27243
The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge family type messages even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. 4.0.0-4.0.1 3.7.11
CM-27229
On a traditional bridge, VLAN tagged traffic is not discarded when it exceeds the port security MAC limit. 4.0.0-4.0.1
CM-27184
With the port security feature, if you change the number of MAC addresses allowed to access a port with the NCLU net add interface <port> port-security mac-limit <number> command, the net show configuration commands command might fail. 4.0.0-4.0.1
CM-27179
On rare occasions on a Mellanox SN3700C switch, if you insert and remove, then reinsert an AOC or QSFP28 optical transceiver quickly, port #32 might get stuck.
To avoid this issue, wait 15 seconds before insertion and before removal of the module.		 4.0.0-4.0.1
CM-27143
The CPU core temperature sensors are absent on the Dell S5248F-ON switch. 4.0.0-4.0.1
CM-27136
With a high number of active routes (20K or more), when you perform a networking restart, the FRR log files might become flooded with error messages associated with the restart. These logs are normal and are not directly a problem. However, the large number of messages can cause the logs to rotate away any previous history, which prevents you from tracing back events leading up to the restart. In a troubleshooting environment, this can be problematic. 4.0.0-4.0.1
CM-27131
On switches with the Broadcom Tomahawk3 ASIC, such as the EdgeCore Minipack AS8000, SPAN and ERSPAN functionality is not supported. 4.0.0-4.0.1
CM-27118
Switches with the Broadcom Tomahawk3 ASIC, such as the EdgeCore Minipack AS8000, might not learn all MAC address on a port configured for bridging when the hardware MAC table is near the maximum capacity. 4.0.0-4.0.1
CM-27099
Precision Time Protocol (PTP) is not currently supported on Mellanox switches with the Spectrum-2 ASIC. 4.0.0-4.0.1
CM-27094
On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. 3.5.0-3.7.11, 4.0.0-4.0.1
CM-27081
On the switches with the Broadcom Tomahawk3 ASIC, such as the EdgeCore Minipack AS8000, if you configure more than 96 ports in a layer 2 bridge, switchd might hit a timeout error and restart. 4.0.0-4.0.1
CM-27018
When more than one VRR interface is configured on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. 3.7.10-3.7.11, 4.0.0-4.0.1
CM-26996
On Mellanox switches with the Spectrum ASIC, the --set-burst parameter in an iptables rule does not take effect. 3.7.10, 4.0.0-4.0.1 3.7.11
CM-26961
On Mellanox switches, error messages with hw-management-thermal-events.sh are displayed on shutdown. 4.0.0-4.0.1
CM-26942
Port security is not currently supported on VX. The NCLU commands produce errors. 4.0.0-4.0.1
CM-26921
If you delete an undefined bond, then add a bond slave, the net commit command fails. 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26913
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf”
should be:
sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf”
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file.		 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26907
NCLU incorrectly allows you to apply port security configuration on layer 2 and layer 3 ports that are not part of a bridge. 4.0.0-4.0.1
CM-26905
When you update the hostname of a switch with the NCLU net add hostname <hostname> command, then run net commit, the lldpd service is not restarted and other devices still see the old name.
To work around this issue, run the sudo systemctl restart lldpd.service command.		 3.7.10-3.7.11, 4.0.0-4.0.1
CM-26875
After deleting an IPv6 numbered BGP peer group neighbor, Cumulus Linux may continue to send RAs. To address this, restart frr after removing IPv6 numbered configuration. 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26769
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. 3.7.6-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26702
On Mellanox switches with the Spectrum-2 ASIC, policy-based routing (PBR) is not currently supported. 4.0.0-4.0.1
CM-26655
Reconfiguring an NTP server via NCLU with different trailing options (such as iburst) after the IP address causes an invalid configuration to be added to the /etc/ntp.conf file. As an example
net add time ntp server 1.2.3.4 iburst
net commit
net add time ntp server 1.2.3.4
net commit
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options.		 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26599
Auto-negotiation does not work with the QSFP28 cables and a remote system opreating at 10G. Attempting to enable auto-negotiation via ethtool -s swp<#> autoneg on returns Operation not supported
As a workaround, do not use auto-negotiation and set the local port speed to 10G.		 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26595
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26525
When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:
OSError: [Errno 24] Too many open files
 3.6.2-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26516
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. 3.7.5-3.7.11, 4.0.0-4.0.1
CM-26450
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. 3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26437
NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.
To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard).		 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26423
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. 3.7.5-3.7.11, 4.0.0-4.0.1
CM-26412
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address flipping between the MLAG bond and the peer link.
To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file.		 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26308
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.
To work around this issue, remove the interface alias description from iproute2.		 3.7.8-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26288
On Mellanox switches, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. 3.7.8-3.7.11, 4.0.0-4.0.1
CM-26256
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. 3.7.8-3.7.11, 4.0.0-4.0.1
CM-26241
On the Dell S5248F-ON switch, smond may generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments and so these messages can be disregarded. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-26225
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2
2019-09-05T05:15:17.274521+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/12-0053/eeprom for psu2
2019-09-05T05:15:17.469556+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2
2019-09-05T05:15:17.497514+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/12-0053/eeprom for psu2
 3.7.9-3.7.11, 4.0.0-4.0.1
CM-26217
NCLU does not allow you to configure OSPF NSSAs. For example: 
cumulus@switch:~$ net add ospf area 0.0.0.1 nssa 
ERROR: Command not found. 
net add ospf area 0.0.0.1 nssa
To work around this issue, use FRR instead. For example: 
switch# configure terminal 
switch(config)# router ospf 
switch(config-router)# area 0.0.0.1 nssa
3.7.7-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26200
The following CVEs were announced that affect the systemd-resolved package.
Cumulus Linux does not enable systemd-resolved by default, so Cumulus Linux is not vulnerable as shipped.
CVE-2019-15718
Missing access controls on systemd-resolved’s D-Bus interface
Source Package Release Version Status: buster 241-7 vulnerable
For the detailed security status, refer to the security tracker page at:
https://security-tracker.debian.org/tracker/CVE-2019-15718		 4.0.0-4.0.1
CM-26179
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error: 
ERROR: ‘ascii’ codec can’t encode character u'\xe9' in position 3: ordinal not in range(128) 
See /var/log/netd.log for more details.
3.7.7-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26158
On Mellanox switches, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. 3.7.8-3.7.10, 4.0.0-4.0.1 3.7.11
CM-26139
Selective ERSPAN does not work when you specify a bridge port. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-26138
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64
 3.7.6-3.7.11, 4.0.0-4.0.1
CM-26137
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64
 3.7.6-3.7.11, 4.0.0-4.0.1
CM-26136
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). 3.7.6-3.7.11, 4.0.0-4.0.1
CM-26024
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly.
To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches.		 3.7.7-3.7.11, 4.0.0-4.0.1
CM-25986
On the Mellanox SN3700C switch, the time required to establish a link (from the time a link is set to admin up until the link becomes operationally up) can take between 5 and 10 seconds. 4.0.0-4.0.1
CM-25890
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). 3.7.0-3.7.11, 4.0.0-4.0.1
CM-25859
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit commands succeeds even though the MTU is not changed as expected.
To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command.		 3.7.7-3.7.11, 4.0.0-4.0.1
CM-25815
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment , if the /etc/network/interfaces file is replaced with a different file that does not have the SVI and layer 2 VNI configuration anymore, the original virtual MAC does not get populated through the EVPN route until FRR is restarted. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-25766
When you run the apt upgrade command on the Dell-N3048EP switch, the upgrade does not work. 3.7.7-3.7.11, 4.0.0-4.0.1
CM-25740
On Broadcom Maverick switches with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags.

To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad: 

 
cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad
3.7.6-3.7.11, 4.0.0-4.0.1
CM-25694
If a packet is policed by ebtables, it does not increment an ACL drop on the ingress interface. Instead, it increments the TDBGC3/6 drop counter to the CPU. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-25693
After you issue the NCLU net del bgp vrf <vrf> autonomous-system <AS> command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. 3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11
CM-25683
NCLU fails to remove the BGP neighbor statement when the BGP unnumbered interface belongs to a VRF. However, if the interface belongs to the default VRF, the BGP neighbor statement is removed. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-25641
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd, and all the sensors might report ABSENT devices in smonctl.

To work around this issue, power cycle the switch.		 3.7.6-3.7.11, 4.0.0-4.0.1
CM-25505
During the bring-up sequence following a reboot, VXLAN routed packets (tenant traffic flows) transiting an MLAG peer are dropped until the clagd init-delay timer expires.
The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd. To route the tenant traffic flows, the kernel must perform address resolution but has to wait for the clagd init-delay timer to expire before the bonds can forward traffic. During the time when the ARP entry is unresolved, packets might be dropped.
During the init-delay period, the ARP cache is not yet populated so the problem exists until either the init-delay timer expires or clagd neighbor synchronization is complete. By default the clagd init-delay timer is set to 10 seconds and clagd neighbor synchronization occurs halfway through the init-delay period. Traffic resumes forwarding after one of the two criteria described above are met.
You might see this issue in EVPN symmetric or centralized configurations with BGP peering over a peer link.
To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result.
In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example: 
 
ip as-path access-list MY_ASN permit ^$ 

route-map peerlink-add-asn permit 10 
match as-path MY_ASN 
set as-path prepend 4200000101 
route-map peerlink-add-asn permit 20
3.7.6-3.7.10, 4.0.0-4.0.1 3.7.11
CM-25400
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. 3.7.6-3.7.11, 4.0.0-4.0.1
CM-25397
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. 3.7.3-3.7.11, 4.0.0-4.0.1
CM-24993
When you try to change the NTP time zone with the NCLU net add time zone <timezone> command or by editing the /etc/timezone file manually, the configuration does not take effect.
To work around this issue, change the time zone with the sudo timedatectl set-timezone <timezone> command. For example:
cumulus@switch:~$ sudo timedatectl set-timezone US/Eastern
 4.0.0-4.0.1
CM-24894
The maximum-prefix configuration under the IPv4 address family has an optional restart value which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. 3.7.5-3.7.11, 4.0.0-4.0.1
CM-24803
When you execute the following command on the Dell N3048EP-ON, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support. 

 
 sudo onie-install -fai http:// 
 sudo reboot

To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image.
The workaround only works when an out-of-band network is present.		 3.7.6-3.7.11, 4.0.1
CM-24799
On switches using the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped.
This issue only affects QinQ configurations.		 3.7.5-3.7.11, 4.0.0-4.0.1
CM-24762
On the EdgeCore AS7326 switch, the 1000BASE-T SFP RJ-45 on a 25G port does not work at 1G. 3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11
CM-24751
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switches, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status
 3.7.3-3.7.11, 4.0.0-4.0.1
CM-24652
In an EVPN environment, the centralized MAC address is not getting installed on the MLAG pair because Cumulus Linux does not perform an SVI MAC check per VLAN.

This issue does not manifest itself in a pure distributed routing (symmetric or asymmetric) environment or in a pure centralized routing environment.		 3.7.0-3.7.11, 4.0.0-4.0.1
CM-24618
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error: 

 
ERROR: No closing quotation 
See /var/log/netd.log for more details.
3.6.1-3.7.11, 4.0.0-4.0.1
CM-24473
SNMP incorrectly requires engine ID specification. 3.7.4-3.7.11, 4.0.0-4.0.1
CM-24435
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces.

For example, this command is incorrect: 

 
net add routing route-map Proxy-ARP permit 25 match interface swp9-10

These commands are correct: 

 
net add routing route-map Proxy-ARP permit 25 match interface swp9 
net add routing route-map Proxy-ARP permit 30 match interface swp10
3.7.2-3.7.11, 4.0.0-4.0.1
CM-24426
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf <name> command just displays . For example: 

 
cumulus@switch:~$ net add vrf mgmt

Tab completion for the net add vrf <name> ip address <address> command works correctly.		 3.7.4-3.7.11, 4.0.0-4.0.1
CM-24379
On Maverick switches, CPU forwarded packets might be dropped when there is no route to a leaked host route. 3.7.5-3.7.11, 4.0.0-4.0.1
CM-24343
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.
To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value.		 3.7.4-3.7.11, 4.0.0-4.0.1
CM-24332
On Broadcom switches, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. 3.7.3-3.7.11, 4.0.0-4.0.1
CM-24272
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.

To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: 

 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface br0.100 
switch(config-if)# vrrp 1 priority 110 
switch(config-if)# vrrp 1 advertisement-interval 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~
3.7.4-3.7.11, 4.0.0-4.0.1
CM-24271
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU.

To work around this issue, run the vtysh command inside FRR to change the default priority. For example: 

 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface vlan100 
switch(config-if)# vrrp 1 priority 110 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~
3.7.4-3.7.11, 4.0.0-4.0.1
CM-24270
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU.
To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: 

 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface swp4 
switch(config-if)# vrrp 1 version 2 
switch(config-if)# no vrrp 1 preempt 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~
3.7.4-3.7.11, 4.0.0-4.0.1
CM-24262
NCLU does not honor “auto all” in the /etc/network/interfaces file and removes the existing configuration if no individual auto <iface> lines exist. 3.7.3-3.7.11, 4.0.0-4.0.1
CM-24241
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example: 

 
cumulus@switch:~$ net del bgp neighbor fabric peer-group 
‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’
3.7.2-3.7.11, 4.0.0-4.0.1
CM-24222
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. 3.7.0-3.7.11, 4.0.0-4.0.1
CM-24035
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23825
The net add interface <interface> ptm-enable command adds no ptm-enable for that interface in the frr.conf file.

Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh.		 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23665
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when using net add vxlan <span class="error">&#91;L3VNI&#93; bridge access <span class="error">&#91;VLAN&#93;
This configuration breaks network connectivity in an MLAG system in an EVPN symmetric routing configuration.
To restore connectivity, you need to remove the VLAN ID from the bridge.		 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23661
When you configure a GRE tunnel on a Mellanox switch, the traffic behind the local tunnel endpoint destined through the GRE tunnel is software-forwarded. 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23651
In an EVPN symmetric routing configuration, when an IP address is frozen, kernel neighbor table information and kernel VRF routing table information about the frozen IP address might be out-of-sync. 3.7.3-3.7.11, 4.0.0-4.0.1
CM-23584
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23570
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.
After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.
To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.
Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G.		 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23418
For QSFP modules, the sudo ifdown command does not disable the Tx laser. 3.7.2-3.7.11, 4.0.0-4.0.1
CM-23417
When using NCLU to create an ibgp peering across the peerlink, the addition of the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new EBGP neighborship when one has already been configured for IBGP. This is unexpected, the existing IBGP configuration is valid. 3.7.0-3.7.11, 4.0.0-4.0.1
CM-23397
On Broadcom switches, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. 3.6.2-3.7.11, 4.0.0-4.0.1
CM-23311
In an EVPN centralized routing configuration, where the layer 2 network extends beyond VTEPs, (for example, host with bridges), the gateway MAC address does not get refreshed in the network when ARP suppression is enabled on the gateway.
To work around this issue, disable ARP suppression on the centralized gateway.		 4.0.0-4.0.1
CM-23075
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces: 

 
2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 
2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51

Eventually the dhcrelay service stops.		 3.7.1-3.7.11, 4.0.0-4.0.1
CM-23021
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. 3.7.1-3.7.11, 4.0.0-4.0.1
CM-22926
The SNMP port state returns an incorrect value of blocking for an interface which is down. The correct value should be disabled. 3.7.1-3.7.11, 4.0.0-4.0.1
CM-22794
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. 3.6.2-3.7.11, 4.0.0-4.0.1
CM-22554
If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware. 3.6.2-3.7.11, 4.0.0-4.0.1
CM-22386
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peerlink. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. 3.7.0-3.7.11, 4.0.0-4.0.1
CM-22301
For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets. 

 
A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type 
IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100

These packets are now policed by catch all rules.

To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100.		 3.6.1-3.7.11, 4.0.0-4.0.1
CM-22287
When a layer 3 ECMP path is brought down on the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. 3.6.2-3.7.11, 4.0.0-4.0.1
CM-22228
Counters associated with VLANs and VRFs are not working on Trident 2+ switches. 3.7.0-3.7.11, 4.0.0-4.0.1
CM-22020
On the Trident3 platform, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly.
To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic.		 3.7.0-3.7.11, 4.0.0-4.0.1
CM-21927
When running ifreload after updating an interface configuration, sometimes VLANs are not programmed into the hardware data plane. The Linux control plane looks normal but the VLAN has not been programmed into the hardware and packets that arrive for the VLAN might be dropped.
To work around this issue, remove and re-add the affected VLANs from the port.		 3.5.3-3.7.11, 4.0.0-4.0.1
CM-21898
On a Trident 3 switch, IGMP packets are not getting policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.

-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100

To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets:

-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police --set-mode pkt --set-rate 100 --set-burst 100

Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done.		 3.6.2-3.7.11, 4.0.0-4.0.1
CM-21785
The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. 3.6.2-3.7.11, 4.0.0-4.0.1
CM-21769
On a Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. 3.6.1-3.7.11, 4.0.0-4.0.1
CM-21678
On a Dell switch with a Maverick ASIC, NetQ might receive false alerts like the following via PagerDuty: 

 
cumulus@switch:~$ netq show sensors temp changes | grep absent | grep -v psu 
P2Leaf01 temp9 networking asic die temp sensor absent 43 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s 
P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to find driver path: /cumulu Add 7d:22h:1m:41s 
P2Leaf01 temp6 networking asic die temp sensor absent 47 105 100 5 Unable to read temp4_highest Add 9d:23h:26m:6s 
P2Leaf01 temp6 networking asic die temp sensor absent 45 105 100 5 Unable to read temp4_highest Add 14d:22h:46m:45s

This message might occur as a result of a timeout at the hardware level, or the switch might be reporting a failure to get a response.		 3.5.3-3.7.11, 4.0.0-4.0.1
CM-21667
FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.
To work around this issue, add ttl-security to individual neighbors instead of the peer group.		 3.6.1-3.7.11, 4.0.0-4.0.1
CM-21278
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.
To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment.		 3.5.3-3.7.10, 4.0.0-4.0.1 3.7.11
CM-21058
The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes. 3.6.0-3.7.11, 4.0.0-4.0.1
CM-21055
On Mellanox switches, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the packets might be dropped by the first transit switch. 3.6.0-3.7.11, 4.0.0-4.0.1
CM-20813
Span rules matching the out-interface as a bond do not mirror packets. 3.6.0-3.7.11, 4.0.0-4.0.1
CM-20508
The Cumulus-Resource-Query-MIB defines the ability to gather buffer utilization status but when these objects are polled, they return nothing. 3.5.3-3.7.11, 4.0.0-4.0.1
CM-20033
The VLAN interface stays up even though the physical link carrying the VLAN is admin or carrier down
 3.5.2-3.7.11, 4.0.0-4.0.1
CM-19788
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.
To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface.		 3.5.0-3.7.11, 4.0.0-4.0.1
CM-19724
PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. 3.5.2-3.7.11, 4.0.0-4.0.1
CM-19454
When you use NCLU to bring a bond admin down (net add bond <bond> link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.
To work around this issue, use the sudo ifdown <bondname> command.		 3.5.0-3.7.11, 4.0.0-4.0.1
CM-17494
In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.
To work around this issue, change the value of arp_ignore to 2. See Default ARP Settings in Cumulus Linux for more information.		 3.3.2-3.7.11, 4.0.0-4.0.1
CM-16571
NCLU cannot manage rsyslog to addresses routed via a VRF. In Cumulus Linux 4.0.0 and later, management VRF is enabled by default. To work around this issue, update the /etc/network/interfaces file to disable management VRF. 3.4.3-3.7.11, 4.0.0-4.0.1
CM-15812
Multicast forwarding fails for IP addresses whose DMAC overlaps with reserved DIPs. 3.2.1-3.7.11, 4.0.0-4.0.1

Fixed Issues in 4.0.1

Issue ID Description Affects

4.0.0 Release Notes

Open Issues in 4.0.0

Issue ID Description Affects Fixed
3330705
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. 3.7.0-5.3.1 5.4.0
3330654
When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), the user name mapping might be incorrect; for example, the user name shown in the default prompt might be incorrect. When you use NVUE, this occurs when the priority for the authentication order of local is higher than tacacs. 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.4.0
3327477
Using su to change to a user specified through TACACS+ results in becoming the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. When sudo asks for the password of the named user, it is unlikely to match that of the local tacacs0 thru tacacs15 user. 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.4.0
3216922
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users). 3.7.0-5.2.1 5.3.0-5.4.0
3216759
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctly
hal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More Resources
To work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode.		 3.7.15-4.4.4 4.4.5
3209699
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users)
 3.7.0-4.3.0, 4.4.0-5.2.1 4.3.1, 5.3.0-5.4.0
3135801
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra
When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop.		 4.0.0-4.3.0, 4.4.0-4.4.5 3.7.16, 4.3.1
3123556
When you configure an interface in FRR to send IPv6 RAs before you configure the interface in the /etc/network/interfaces file, the switch does not process IPv6 RAs. To work around this issue, remove the interface configuration in FRR and reapply it. 3.7.15-4.3.0, 4.4.0-5.1.0 4.3.1, 5.2.0-5.4.0
3119615
In an MLAG topology, if you admin down a single connected interface, any dynamic MAC addresses on the peer link are flushed, then added back momentarily, which creates a disruption in traffic. 3.7.15-5.1.0 5.2.0-5.4.0
3093863
The snmpd process will slowly leak memory when you poll TCP-MIB objects. To work around this issue, restart the snmpd service to free memory with the systemctl restart snmpd command. 3.7.16-4.4.3 4.4.4-4.4.5, 5.2.0-5.4.0
3077737
The update-ports.service fails because a blank space in the comment lines of the /etc/cumulus/ports.conf file causes parsing errors
To work around this issue, remove the blank spaces in the commented lines, then restart the update-ports and switchd services.		 3.7.15-4.3.0 4.3.1-4.4.5, 4.4.4-4.4.5
3066704
The hostapd service stops working if an 802.1X interface goes up and down many times over a long period of time
To work around this issue, restart the hostapd service with the systemctl restart hostapd command.		 3.7.15-4.3.0 4.3.1-4.4.5
3021693
When ARP suppression is off, Cumulus Linux sends GARPs from neighmgrd for remote neighbors over VXLAN. 3.7.15-4.3.0, 4.4.0-4.4.3, 5.0.0-5.1.0 4.3.1, 4.4.4-4.4.5, 5.2.0-5.4.0
3007564
After you delete the last vxlan-remoteip configuration line from the /etc/network/interfaces file and run the ifreload -a command, the corresponding BUM flood entry is not removed. 3.7.15-5.0.1 5.1.0-5.4.0, 5.2.0-5.4.0
2991514
Cumulus Linux can take a long time (100 seconds) to sync a large number of VNIs on a bridge. 3.7.15-4.3.0 4.3.1-4.4.5
2961008
SNMP reports the same ifType of ethernetCsmacd(6) for loopback interfaces. 3.7.15-4.4.2, 5.0.0-5.0.1 4.4.3-4.4.5, 5.1.0-5.4.0
2959067
ECMP produces errors indicating No More Resources and switchd crashes even when ECMP utilization is low. 3.7.14.2-4.2.1 4.3.0-4.4.5
2949512
On the EdgeCore AS4610-54T switch, the fan speed reports a minimum threshold in the logs. 3.7.15-4.3.0 4.3.1-4.4.5
2899422
Broadcom switches return a table full error when creating VXLAN gports, which causes {switchd to crash. 3.7.15-4.3.0 4.3.1-4.4.5
2896733
Traffic failover in a multicast topology with redundancy has the mroute stuck in a prune state and PIM join messages continue to send. To work around this issue, run the vtysh clear ip mroute command. 3.7.15-4.3.0, 5.0.0-5.0.1 4.3.1-4.4.5, 5.1.0-5.4.0
2893895
CVE-2020-35498: A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability
Vulnerable: <= 2.8.90-1-cl4u5Fixed: 2.8.90-1-cl4u6, 2.8.90-1-cl4.4.0u1, 2.8.90-1-cl5.0.0u8		 4.0.0-4.3.1 4.4.0-4.4.5, 5.1.0-5.4.0
2891255
CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file
Vulnerable: <= 2.6.20-0+deb10u1Fixed: 2.6.20-0+deb10u2		 4.0.0-4.4.1, 5.0.0-5.4.0 4.4.2-4.4.5
2890681
CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code
Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1		 4.0.0-4.4.1, 5.0.0-5.4.0 4.4.2-4.4.5
2867058
On the Dell Z9264F-ON switch, interfaces that use the QSFP28 module remain down after you restart switchd. 3.7.15-4.3.0 4.3.1-4.4.5
2866084
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del
dev [dst|via] <interface|IP> command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:
$ cat /etc/network/ifupdown2/policy.d/vxlan.json
  {
       “vxlan”: {
           “module_globals”: { “vxlan-purge-remotes”: “no” },
           “defaults”: {
               “vxlan-ageing”: “1800”,
               “vxlan-port”: “4789”, <==== This comma needs to be added at the end of this line
               “vxlan-learning”: “off” <= This line needs to be added
            }
       }
  }
Reboot the affected switches.
 3.7.12-4.3.0 4.3.1-4.4.5
2859177
The cl-route-check –layer3 command fails with a memory error. For example:
cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last):
File “/usr/cumulus/bin/cl-route-check”, line 1270, in 
 routing.collect_data()
File “/usr/cumulus/bin/cl-route-check”, line 528, in collect_data
 self.collect_data_bgp_ipv4()
File “/usr/cumulus/bin/cl-route-check”, line 711, in collect_data_bgp_ipv4
 bgp_ipv4 = json.loads(output)
File “/usr/lib/python2.7/json/init.py”, line 338, in loads
 return _default_decoder.decode(s)
File “/usr/lib/python2.7/json/decoder.py”, line 366, in decode
 obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File “/usr/lib/python2.7/json/decoder.py”, line 382, in raw_decode
 obj, end = self.scan_once(s, idx)MemoryError
 3.7.15-4.4.1 4.4.2-4.4.5
2840819
CVE-2021-25219: The lame server cache in BIND, a DNS server implementation, can be abused by an attacker to significantly degrade resolver performance, resulting in denial of service (large delays for responses for client queries and DNS timeouts on client hosts). 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.2-4.4.5, 5.0.0-5.4.0
2821869
The cl-route-check –layer3 command fails with a memory error. For example:
cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last):
File “/usr/cumulus/bin/cl-route-check”, line 1270, in 
 routing.collect_data()
File “/usr/cumulus/bin/cl-route-check”, line 528, in collect_data
 self.collect_data_bgp_ipv4()
File “/usr/cumulus/bin/cl-route-check”, line 711, in collect_data_bgp_ipv4
 bgp_ipv4 = json.loads(output)
File “/usr/lib/python2.7/json/init.py”, line 338, in loads
 return _default_decoder.decode(s)
File “/usr/lib/python2.7/json/decoder.py”, line 366, in decode
 obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File “/usr/lib/python2.7/json/decoder.py”, line 382, in raw_decode
 obj, end = self.scan_once(s, idx)MemoryError
 3.7.15-4.4.5 5.0.0-5.4.0
2792750
If you change the clagd-vxlan-anycast-ip setting on both MLAG peers at the same time, both peers use their unique VTEP address indefinitely. 3.7.15-4.3.0, 4.4.0-4.4.5 4.3.1
2782033
The following vulnerabilities have been announced in the openssl packages:CVE-2021-3711: buffer overflow vulnerability in SM2 decryption
CVE-2021-3712: buffer overrun when processing ASN.1 strings in the X509_aux_print() function
More details at https://www.openssl.org/news/secadv/20210824.txt
Vulnerable: <= 1.1.1d-0+deb10u6Fixed: 1.1.1d-0+deb10u7		 4.0.0-4.4.1 4.4.2-4.4.5
2755615
When route_preferred_over_neigh is set to FALSE in the /etc/cumulus/switchd.conf file, host routes (/32 or /128) are used for forwarding in hardware instead of a local neighbor entry. 4.0.0-4.3.0, 4.4.0-4.4.1 4.3.1, 4.4.2-4.4.5, 5.0.0-5.4.0
2754691
CVE-2021-3672: in c-ares, a library that performs DNS requests and name resolution asynchronously, missing input validation of hostnames returned by DNS servers can lead to output of wrong hostnames (leading to Domain Hijacking)
Vulnerable: 1.14.0-1Fixed: 1.14.0-1+deb10u1		 4.0.0-4.4.1 4.4.2-4.4.5
2754685
CVE-2021-38165: lynx, a non-graphical (text-mode) web browser, does not properly handle the userinfo subcomponent of a URI, which can lead to leaking of credential in cleartext in SNI data
Vulnerable: 2.8.9rel.1-3Fixed: 2.8.9rel.1-3+deb10u1		 4.0.0-4.4.1 4.4.2-4.4.5
2754679
CVE-2020-26558 / CVE-2021-0129: Bluez does not properly check permissions during pairing operation, which could allow an attacker to impersonate the initiating device
CVE-2020-27153: a double free flaw in the disconnect_cb() routine in the gattool. A remote attacker can take advantage of this flaw during service discovery for denial of service, or potentially, execution of arbitrary code
Vulnerable: <= 5.50-1.2~deb10u1Fixed: 5.50-1.2~deb10u2		 4.0.0-4.4.1 4.4.2-4.4.5
2747605
CVE-2021-3246: a buffer overflow in libsndfile, a libraryfor reading/writing audio files, which could result in denial of serviceor potentially the execution of arbitrary code when processing amalformed audio file
Vulnerable: 1.0.28-6Fixed: 1.0.28-6+deb10u1		 4.0.0-4.4.1 4.4.2-4.4.5
2743186
When you use MD5 passwords and you configure a non-default VRF before the default VRF in the /etc/frr/frr.conf file, numbered BGP sessions do not establish. 3.7.15-5.1.0 5.2.0-5.4.0
2739690
CVE-2021-22918: An out-of-bounds read was discovered in the uv__idna_to_ascii() function of Libuv, an asynchronous event notification library, which could result in denial of service or information disclosure
Vulnerable: 1.24.1-1Fixed: 1.24.1-1+deb 10u1		 4.0.0-4.4.1 4.4.2-4.4.5
2739639
CVE-2021-36222: It was discovered that the Key Distribution Center (KDC) in krb5, the MIT implementation of Kerberos, is prone to a NULL pointer dereference flaw. An unauthenticated attacker can take advantage of this flaw to cause a denial of service (KDC crash) by sending a request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST
Vulnerable: <= 1.17-3+deb10u1Fixed: 1.17-3+deb10u2		 4.0.0-4.4.1 4.4.2-4.4.5
2734122
CVE-2021-33910: The Qualys Research Labs discovered that an attacker-controlled allocation using the alloca() function could result in memorycorruption, allowing to crash systemd and hence the entire operating system. Details can be found at https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.txt
Vulnerable: <= 241-7~deb10u7Fixed: 241-7~deb10u8		 4.0.0-4.4.1 4.4.2-4.4.5
2734107
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. 3.7.12-4.4.1 4.4.2-4.4.5
2730225
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. 3.7.12-4.3.0, 4.4.0-4.4.1 4.3.1, 4.4.2-4.4.5
2728207
CVE-2021-3570: A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 3.7.0-3.7.16, 4.0.0-4.4.5
2728206
CVE-2021-3570: A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 3.7.0-3.7.16, 4.0.0-4.4.5
2728205
CVE-2021-3570: A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 3.7.0-4.4.1 4.4.2-4.4.5
2728138
CVE-2020-36221, CVE-2020-36222, CVE-2020-36223, CVE-2020-36224, CVE-2020-36225, CVE-2020-36226, CVE-2020-36227, CVE-2020-36228, CVE-2020-36229, CVE-2020-36230: Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets.
Vulnerable: <= 2.4.47+dfsg-3+deb10u4
Fixed: 2.4.47+dfsg-3+deb10u5		 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2728134
CVE-2021-27212: A vulnerability in the Certificate List Exact Assertion validation was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of this flaw to cause a denial of service (slapd daemon crash) via specially crafted packets.
Vulnerable: <= 2.4.47+dfsg-3+deb10u5
Fixed: 2.4.47+dfsg-3+deb10u6		 4.0.0-4.3.1 4.4.0-4.4.5
2716822
The /etc/cumulus/ports.conf file on the Dell Z9264F-ON switch does not show that Cumulus Linux does not support the 2x10G SFP+ ports. 3.7.15-4.3.0 4.3.1-4.4.5
2713888
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctly
hal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More Resources
To work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode.		 3.7.15-5.0.1 5.1.0-5.4.0
2699399
When you run the vtysh show ip bgp vrf statistics command, the bgpd service crashes if you use vrf all. For example:
spine01# show ip bgp vrf all statistics vtysh: error reading from bgpd: Success (0)Warning: closing connection to bgpd because of an I/O error!
To workaround this issue, run the command against each VRF independently.		 3.7.15, 4.0.0-4.3.0 3.7.16, 4.3.1-4.4.5
2695526
CVE-2021-3580 CVE-2021-20305: Multiple vulnerabilities were discovered in nettle, a low level cryptographic library, which could result in denial of service (remote crash in RSA decryption via specially crafted ciphertext, crash on ECDSA signature verification) or incorrect verification of ECDSA signatures
Vulnerable: 3.4.1-1Fixed: 3.4.1-1+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2687332
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usage
To workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:
address-family ipv4 unicast
  aggregate-address 10.10.0.0/16 summary-only
  redistribute connected
After:
ip route 10.10.0.0/16 Null0
  !
  address-family ipv4 unicast
  redistribute connected route-map DENY-COMPONENTS
  redistribute static
   exit-address-family
  ip prefix-list NO-COMPONENTS seq 5 permit 10.10.0.0/16 ge 17
  !
  route-map DENY-COMPONENTS deny 10
   match ip address prefix-list NO-COMPONENTS
  !
  route-map DENY-COMPONENTS permit 20
This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed.		 3.7.12-4.2.1 4.3.0-4.4.5
2687159
CVE-2018-25009 CVE-2018-25010 CVE-2018-25011 CVE-2018-25012 CVE-2018-25013 CVE-2018-25014 CVE-2020-36328 CVE-2020-36329 CVE-2020-36330 CVE-2020-36331 CVE-2020-36332: Multiple vulnerabilities were discovered in libwebp, the implementation of the WebP image format, which could result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed images are processed
Vulnerable: 0.6.1-2Fixed: 0.6.1-2+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2685994
When you use the NVUE command nv set interface lo router ospf area to configure OSPF on a loopback interface, the configuration fails to apply
To work around this issue, configure the loopback interface in the desired OSPF area with the nv set vrf default router ospf area 0 network command and reference the assigned prefix of the loopback interface. For example:
cumulus@leaf01:~$ nv set vrf default router ospf area 0 network 10.10.10.1/32
 4.0.0-5.0.1 5.1.0-5.4.0
2682971
CVE-2020-12762: integer overflow in the json-c JSON library, which could result in denial of service or potentially the execution of arbitrary code if large malformed JSON files are processed
Vulnerable: 0.12.2+cl4u1Fixed: 0.12.2+cl4.4.0u1		 4.0.0-4.3.1 4.4.0-4.4.5
2679950
CVE-2021-25217: parsing of stored leases by dhclient or dhcpd has an incorrect length check that may cause a crash
Vulnerable: <= 4.3.1-6-cl3.7.14u1Fixed: 4.3.1-6-cl3.7.16u1		 3.7.0-3.7.15, 4.0.0-4.3.1 3.7.16, 4.4.0-4.4.5
2677049
CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687: Several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server, could result in denial of service, cache poisoning or the execution of arbitrary code. 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2671667
CVE-2021-23017: off-by-one in Nginx, a high-performance web and reverse proxy server, which couldresult in denial of service and potentially the execution of arbitrary code
Vulnerable: <= 1.14.2-2+deb10u3Fixed: 1.14.2-2+deb10u4		 4.0.0-4.3.1 4.4.0-4.4.5
2669858
OpenSSH is vulnerable to CVE-2020-14145, as described in https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf.
This is an information leak in algorithm negotiation that can allow man-in-the-middle attacks on initial connection attempts without a previously stored server host key on the client. If desired, mitigation using UpdateHostKeys and HostKeyAlgorithms is also given in that paper.		 3.7.14-3.7.16, 4.0.0-4.4.5
2666838
CVE-2021-31535: missing length validation in various functions provided by libx11, the X11 client-side library, allow to inject X11 protocol commands on X clients, leading to authentication bypass, denial of service or potentially the execution of arbitrary code
Vulnerable: <= 1.6.7-1+deb10u1Fixed: 1.6.7-1+deb10u2		 4.0.0-4.3.1 4.4.0-4.4.5
2663479
CVE-2021-3520: integer overflow flaw in lz4, a fast LZ compression algorithm library, resulting in memory corruption
Vulnerable: 1.8.3-1Fixed: 1.8.3-1+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2656527
CVE-2020-18032: A buffer overflow was discovered in Graphviz, which could potentially result in the execution of arbitrary code when processing a malformed file
Vulnerable: 2.40.1-6Fixed: 2.40.1-6+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2652003
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static FDB entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface dot1x command, then add back the 802.1x configuration. 3.7.10-4.3.0 4.3.1-4.4.5
2648658
If you try to use more than one percent of max-ecmp-nexthops, you get an error indicating a failure. 3.7.15-4.3.1 4.4.0-4.4.5
2648587
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. 3.7.8-3.7.14.2, 4.0.0-4.3.0 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5
2644053
The following vulnerabilities have been announced in BIND:CVE-2021-25214: a malformed incoming IXFR transfer could trigger an assertion failure in named, resulting in denial of service
CVE-2021-25215: named could crash when a DNAME record placed in the ANSWER section during DNAME chasing turned out to be the final answer to a client query
CVE-2021-25216: the SPNEGO implementation used by BIND is prone to a buffer overflow vulnerability. This update switches to use the SPNEGO implementation from the Kerberos libraries
Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u4Fixed: 9.11.5.P4+dfsg-5.1+deb10u5		 4.0.0-4.3.1 4.4.0-4.4.5
2633062
The following vulnerability affects the libgstreamer-plugins-base1.0-0 package. There is no CVE yet; the Debian advisory number is DSA-4903-1
Multiple vulnerabilities were discovered in plugins for the GStreamer media framework, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened
Vulnerable: 1.14.4-2Fixed: 1.14.4-2+deb10u1		 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2617000
CVE-2021-26933 CVE-2021-27379Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or memory disclosure
Vulnerable: < 4.11.4+99-g8bce4698f6-1Fixed: 4.11.4+99-g8bce4698f6-1		 4.0.0-4.3.1 4.4.0-4.4.5
2616998
CVE-2021-23358: missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code
Vulnerable: 1.9.1~dfsg-1Fixed: 1.9.1~dfsg-1+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2616987
CVE-2020-6851 CVE-2020-8112 CVE-2020-15389 CVE-2020-27814 CVE-2020-27823 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845: Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec, which could result in denial of service or the execution of arbitrary code when opening a malformed image
Vulnerable: <= 2.3.0-2+deb10u1Fixed: 2.3.0-2+deb10u2		 4.0.0-4.3.1 4.4.0-4.4.5
2616976
Multiple vulnerabilities were discovered in cURL, an URL transfer library:CVE-2020-8169: partial password leak to DNS servers
CVE-2020-8177: malicious server could cause curl -J -i to overwrite a local file
CVE-2020-8231: libcurl with CURLOPT_CONNECT_ONLY information leak due to wrong connection
CVE-2020-8284: PASV response could trick curl into connecting back to an arbitrary IP address and port
CVE-2020-8285: libcurl could run out of stack space using FTP wildcard matching (CURLOPT_CHUNK_BGN_FUNCTION)
CVE-2020-8286: failure to verify that OSCP response matches intended certificate
CVE-2021-22876: libcurl did not strip user credentials from URL when populating Referer HTTP request header
CVE-2021-22890: libcurl using HTTPS proxy with TLS1.3 could use the wrong session ticket and bypass server TLS certificate check
Vulnerable: <= 7.64.0-4+deb10u1Fixed: 7.64.0-4+deb10u2		 4.0.0-4.3.1 4.4.0-4.4.5
2616967
CVE-2021-28957: lxml, a Python binding for the libxml2 and libxslt libraries, did not properly sanitize its input. This would allow a malicious user to mount a cross-site scripting attack
Vulnerable: <= 4.3.2-1+deb10u2Fixed: 4.3.2-1+deb10u3		 4.0.0-4.3.1 4.4.0-4.4.5
2616964
CVE-2021-27291: Pygments, a syntax highlighting package written in Python 3, used regular expressions which could result in denial of service
Vulnerable: <= 2.3.1+dfsg-1+deb10u1Fixed: 2.3.1+dfsg-1+deb10u2		 4.0.0-4.3.1 4.4.0-4.4.5
2616954
CVE-2021-3449: A NULL pointer dereference was found in the signature_algorithms processing in OpenSSL, a Secure Sockets Layer toolkit, which could result in denial of service
Vulnerable: <= 1.1.1d-0+deb10u5Fixed: 1.1.1d-0+deb10u6		 4.0.0-4.3.1 4.4.0-4.4.5
2578872
CVE-2021-20270: It was discovered that Pygments, a syntax highlighting package written in Python, could be forced into an infinite loop, resulting in denial of service
Vulnerable: 2.3.1+dfsg-1Fixed: 2.3.1+dfsg-1+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2578870
CVE-2020-35523 CVE-2020-35524: Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed
Vulnerable: <= 4.1.0+git191117-2~deb10u1Fixed: 4.1.0+git191117-2~deb10u2		 4.0.0-4.3.1 4.4.0-4.4.5
2566880
CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. 3.7.14-3.7.14.2, 4.0.0-4.3.1 3.7.15-3.7.16, 4.4.0-4.4.5
2564534
Several vulnerabilities have been discovered in the GRUB2 bootloader
CVE-2020-14372: It was discovered that the acpi command allows a privileged user to load crafted ACPI tables when Secure Boot is enabled
CVE-2020-25632: A use-after-free vulnerability was found in the rmmod command
CVE-2020-25647: An out-of-bound write vulnerability was found in the grub_usb_device_initialize() function, which is called to handle USB device initialization
CVE-2020-27749: A stack buffer overflow flaw was found in grub_parser_split_cmdline
CVE-2020-27779: It was discovered that the cutmem command allows a privileged user to remove memory regions when Secure Boot is enabled
CVE-2021-20225: A heap out-of-bounds write vulnerability was found in the short form option parser
CVE-2021-2023: A heap out-of-bound write flaw was found caused by mis-calculation of space required for quoting in the menu rendering.		 4.0.0-4.3.1 4.4.0-4.4.5
2556782
CVE-2021-0326: An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution.
Vulnerable: <= 2.8.0-cl3.7.14u1, <= 2.8.0-cl4.2.1u1		 3.7.14-3.7.14.2, 4.0.0-4.3.1 3.7.15-3.7.16, 4.4.0-4.4.5
2556777
CVE-2021-26937: A flaw in the handling of combining characters in screen, a terminal multiplexer with VT100/ANSI terminal emulation can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence.
Vulnerable: 4.6.2-3
Fixed: 4.6.2-3+deb10u1		 4.0.0-4.3.1 4.4.0-4.4.5
2556775
DSA-4859-1 (no CVE): zstd, a compression utility, was vulnerable to a race condition: it temporarily exposed, during a very short timeframe, a world-readable version of its input even if the original file had restrictive permissions.
Vulnerable: <= 1.3.8+dfsg-3+deb10u1
Fixed: 1.3.8+dfsg-3+deb10u2		 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2556764
In a configuration with both traditional and vlan-aware bridges, the VLAN membership check on a vlan-aware switch does not drop PVST BPBUs that come from a traditional bridge. 3.7.14-3.7.14.2, 4.0.0-4.3.0 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5
2556730
CVE-2020-8625: A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, a DNS server implementation, which could result in denial of service (daemon crash), or potentially the execution of arbitrary code.
Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u2
Fixed: 9.11.5.P4+dfsg-5.1+deb10u3		 4.0.0-4.3.1 4.4.0-4.4.5
2556691
The following vulnerabilities have been announced in the openssl packages:
CVE-2021-23840: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.
CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained
within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.
CVE-2019-1551: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME.
Vulnerable: <= 1.1.1d-0+deb10u4
Fixed: 1.1.1d-0+deb10u5		 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2556569
DSA-4850-1 (no CVE): libzstd adds read permissions to files while being compressed or uncompressed.
Vulnerable: 1.3.8+dfsg-3
Fixed: 1.3.8+dfsg-3+deb10u1		 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2556500
Cumulus Linux does not support bond members at 200G or greater. 4.0.0-4.3.0 4.3.1-4.4.5, 4.4.0-4.4.5
2556279
CVE-2021-3156: A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug.
Vulnerable: <= 1.8.27-1+deb10u2
Fixed: 1.8.27-1+deb10u3		 4.0.0-4.2.1 4.3.0-4.4.5
2556217
The following vulnerability affects lldpd:
CVE-2020-27827: A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine.
Fixed: 1.0.4-0-cl4.3.0u2		 3.7.14-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2556037
After you add an interface to the bridge, an OSPF session flap might occur
 3.7.9-4.2.0 4.2.1-4.4.5
2556010
On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. 3.7.14, 4.0.0-4.4.5 3.7.14.2-3.7.16
2555908
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up
To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command.		 3.7.12-4.0.1 4.1.0-4.4.5
2555761
The following vulnerabilities were announced in the p11-kit (libp11-kit0) packages:
CVE-2020-29361: Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
CVE-2020-29362: A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.
CVE-2020-29363: A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Vulnerable: 0.23.15-2
Fixed: 0.23.15-2_deb10u1		 4.0.0-4.2.1 4.3.0-4.4.5
2555528
In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer.
To work around this issue, increase the burst value of the ARP policers to 200 or higher.		 3.7.14-4.2.1 4.3.0-4.4.5
2555400
On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. 3.7.14-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2555373
CVE-2020-27350: Missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files.
CVE-2020-27351: Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service.
Vulnerable: apt <= 1.8.2.1, python-apt <= 1.8.4.1
Fixed: apt 1.8.2.2, python-apt 1.8.4.3		 4.0.0-4.2.1 4.3.0-4.4.5
2555339
The following vulnerability has been announced in OpenSSL:
CVE-2020-1971: A flaw in the GENERAL_NAME_cmp() function could cause a NULL dereference when both GENERAL_NAMEs contain an EDIPARTYNAME, resulting in denial of service. More information can be found at https://www.openssl.org/news/secadv/20201208.txt .
Vulnerable: <= 1.1.1d-0+deb10u3
Fixed: 1.1.1d-0+deb10u4		 4.0.0-4.2.1 4.3.0-4.4.5
2554990
When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes.
To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond.		 3.7.13-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2554982
CVE-2020-28196: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Vulnerable: 1.17-3
Fixed: 1.17-3+deb10u1		 4.0.0-4.2.1 4.3.0-4.4.5
2554834
CVE-2020-25709, CVE-2020-25710: Two vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets.
Vulnerable: <= 2.4.47+dfsg-3+deb10u3
Fixed: 2.4.47+dfsg-3+deb10u4		 4.0.0-4.2.1 4.3.0-4.4.5
2554785
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:
Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!
To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor
2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command
4. Reboot the switch.		 3.7.11-4.2.1 4.3.0-4.4.5
2554720
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. 3.7.12-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2554707
On the Dell S5048F-ON switch, optical transceivers do not come up and the modules are in reset mode. 4.0.0-4.2.1 4.3.0-4.4.5
2554588
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is running
To work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:
DHCPD_PID="-pf {0}”
to:
DHCPD_PID="-pf {1}"
 3.7.13-4.2.1 4.3.0-4.4.5
2554533
On the ARM platform, NTP peer associations slowly increase to larger offsets (~500ms). 4.0.0-4.4.5
2554369
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. 3.7.12-4.2.1 4.3.0-4.4.5
2553887
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:

ERROR: You do not have permission to execute that command.

To work around this issue, remove the DEFAULT user from the TACACS+ server.		 3.7.7-3.7.16, 4.0.0-4.4.5
2553731
A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2553677
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:

cumulus@switch:mgmt-vrf:~$ sudo net-snmp-config –create-snmpv3-user -a shaauthpass -x aesprivpass -A SHA -X AES userSHAwithAES
adding the following line to /var/lib/snmp/snmpd.conf:           
   createUser userSHAwithAES SHA “shaauthpass” AES “aesprivpass”       
adding the following line to /snmp/snmpd.conf:                           
   rwuser userSHAwithAES                                           
touch: cannot touch ‘/snmp/snmpd.conf’: No such file or directory
/usr/bin/net-snmp-create-v3-user: 144: /usr/bin/net-snmp-create-v3-user: cannot create /snmp/snmpd.conf: Directory nonexistent

To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:

cumulus@switch:mgmt-vrf:~$ net add snmp-server username user999 auth-md5 user999password encrypt-des user999encryption

Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation.		 3.7.13-3.7.16, 4.0.0-4.4.5
2553586
Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist.
To work around this issue, disable IGMP snooping on the switch.		 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2553219
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. 3.7.12-4.2.1 4.3.0-4.4.5
2553116
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.
To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool.		 3.7.12-3.7.16, 4.0.0-4.4.5
2552939
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. 3.7.12-4.2.1 4.3.0-4.4.5
2552869
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.
To work around this issue, use the ethtool -m command.		 3.7.13-4.2.1 4.3.0-4.4.5
2552858
The following vulnerabilities have been announced in the BIND9 server, which is available for optional installation:
CVE-2020-8619: an asterisk character in an empty non-terminal can cause an assertion failure, resulting in denial of service.
CVE-2020-8622: a truncated TSIG response can lead to an assertion failure, resulting in denial of service.
CVE-2020-8623: a flaw in the native PKCS#11 code can lead to a remotely triggerable assertion failure, resulting in denial of service.
CVE-2020-8624: update-policy rules of type “subdomain” are enforced incorrectly, allowing updates to all parts of the zone along with the intended subdomain.
Vulnerable: <= 9.11.5.P4+dfsg-5.1+deb10u1
Fixed: 9.11.5.P4+dfsg-5.1+deb10u2		 4.0.0-4.2.0 4.2.1-4.4.5
2552853
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. 3.7.12-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2552817
CVE-2020-11724: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
Vulnerable: <= 1.14.2-2+deb10u2
Fixed: 1.14.2-2+deb10u3		 4.0.0-4.2.0 4.2.1-4.4.5
2552742
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.
To work around this issue, restart switchd.		 3.7.12-4.2.1 4.3.0-4.4.5
2552704
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. 3.7.10-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2552610
The following vulnerability has been announced:
CVE-2019-11360: A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c.		 3.7.13-4.2.0 4.2.1-4.4.5
2552607
The following vulnerability has been announced:
CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request.
Fixed: 5.8.0-cl4.2.1u1, 5.8.0-cl3.7.14u1		 3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2552555
The following vulnerability has been announced:
CVE-2019-20795: iproute2 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c.
Vulnerable: <= 4.19.0-cl4u3		 4.0.0-4.2.0 4.2.1-4.4.5
2552527
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. 3.7.7-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2552505
Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports.
To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file.		 3.7.11-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2552297
The following vulnerability has been announced in net-snmp:
CVE-2020-15862: A privilege escalation involving the NET-SNMP-EXTEND-MIB support (which is enabled by default at compile-time).
The fixed versions disable NET-SNMP-EXTEND-MIB support.

Vulnerable: <= 5.8.0-cl3u11, <= 5.8.0-cl4u4
Fixed: 5.8.0-cl3.7.14u3, 5.8.0-cl4.2.1u1		 3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2552294
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command.
 3.7.12-3.7.16, 4.0.0-4.4.5
2552283
Several vulnerabilities have been discovered in the GRUB2 bootloader.
CVE-2020-10713: A flaw in the grub.cfg parsing code was found allowing to break UEFI Secure Boot and load arbitrary code. Details can be found at https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
CVE-2020-14308: It was discovered that grub_malloc does not validate the allocation size allowing for arithmetic overflow and subsequently a heap-based buffer overflow.
CVE-2020-14309: An integer overflow in grub_squash_read_symlink may lead to a heap-based buffer overflow.
CVE-2020-14310: An integer overflow in read_section_from_string may lead to a heap-based buffer overflow.
CVE-2020-14311: An integer overflow in grub_ext2_read_link may lead to a heap-based buffer overflow.
CVE-2020-15706: script: Avoid a use-after-free when redefining a function during execution.
CVE-2020-15707: An integer overflow flaw was found in the initrd size handling.
Vulnerable: <= 2.02+dfsg1-20, <= 2.02+dfsg1-cl4u1
Fixed: 2.02+dfsg1-20+deb10u2, 2.02+dfsg1-cl4.2.1u1		 4.0.0-4.2.0 4.2.1-4.4.5
2552266
OpenSSH scp is vulnerable to CVE-2020-15778, where clients that have authorized access to the SSH server can execute commands on the server by copying maliciously named files.
The two scenarios where an exploit may be useful to an attacker:
-The user is authorized to scp but not ssh (based on the command option in the authorized_keys file), so this vulnerability can allow executing a remote command on the target computer when not authorized to do so.
-An attacker plants a maliciously named file in a directory tree that someone later uses scp -r to copy over to the target computer.
Be aware that restricting users to scp by using the command option in the authorized_keys file is not effective in preventing those users from executing arbitrary commands on the server.
If you want to use scp -r to copy directory trees, avoid copying directory trees to which attackers may have added maliciously-named files. Archiving the directory tree with tar, zip, or a similar program, then copying the archive over to be extracted on the server avoids having to use scp -r altogether. In addition, OpenSSH provides sftp, which you can use instead of scp to copy files.
To disable scp completely, use /bin/chmod 0 /usr/bin/scp .		 3.7.14-3.7.16, 4.0.0-4.4.5
2552204
If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.
To work around this issue, ifdown/ifup the SVI when a MAC address changes.		 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2552203
The following vulnerability has been announced in QEMU:
CVE-2020-8608: In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
Vulnerable: <= 3.1+dfsg-8+deb10u6
Fixed: 3.1+dfsg-8+deb10u7		 4.0.0-4.2.0 4.2.1-4.4.5
2551896
Several denial of service vulnerabilities have been announced in the qemu packages:
CVE-2020-10756 CVE-2020-13361 CVE-2020-13362 CVE-2020-13754 CVE-2020-13659
Vulnerable: <= 1:3.1+dfsg-8+deb10u5
Fixed: 1:3.1+dfsg-8+deb10u6		 4.0.0-4.2.0 4.2.1-4.4.5
2551853
The following vulnerabilities have been announced in the nss packages, including libnss3, which may be used by other programs:
CVE-2019-17006: Check length of inputs for cryptographic primitives
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.
CVE-2020-12399: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.
CVE-2020-12402: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
Vulnerable: <= 3.42.1-1+deb10u2
Fixed: 3.42.1-1+deb10u3		 4.0.0-4.2.0 4.2.1-4.4.5
2551771
When a specific PIM join/prune packet is received from a PIM neighbor the pimd process might crash with a core file. 4.0.0-4.1.1 4.2.0-4.4.5
2551747
In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551730
When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551727
In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551713
There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551674
When you restart clagd, the edge port setting on the peer link changes. 3.7.2-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551665
On the QuantaMesh T1048-LY4 switch, pluggables inserted into SFP+ ports are not detected.
To workaround this issue, downgrade to Cumulus Linux 3.7 ESR.		 4.0.0-4.2.0 4.2.1-4.4.5
2551650
The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. 3.7.12-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2551578
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. 3.7.12-3.7.16, 4.0.0-4.4.5
2551335
When TACACS+ is configured and the management VRF is enabled, users with privilege level 13 are prevented from running ip and cat commands. 4.0.0-4.4.5
2551162
switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.
To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart.		 3.7.11-3.7.12, 4.0.0-4.2.0 3.7.13-3.7.16, 4.2.1-4.4.5
2551124
When the dynamic or static flag on a bridge fdb (MAC) entry is changed to the opposite state, the new flag is not set appropriately in hardware. This can allow a static fdb entry to be unexpectedly learned dynamically on a different interface, or can prevent a dynamic entry from being updated or learned elsewhere.
This condition can occur during a manual replacement of a local MAC address or when EVPN updates a dynamic MAC address to add or remove the Sticky Mac flag. Either situation results in the MAC address keeping the original flag in hardware.
To work around this issue, delete or withdraw the fdb entry, then add the static MAC address directly. For example:

bridge fdb del 50:6b:4b:ee:ee:ee dev swp31 vlan 24 master
bridge fdb add 50:6b:4b:ee:ee:ee dev swp31 vlan 24 master [ static | dynamic ]

If you are unable to delete an EVPN-learned remote MAC address, you can replace the dynamic MAC address with a local static one, then delete the static MAC address. For example:

bridge fdb replace 50:6b:4b:ee:ee:ee dev swp31 vlan 24 master static
bridge fdb del 50:6b:4b:ee:ee:ee dev swp31 vlan 24 master
bridge fdb add 50:6b:4b:ee:ee:ee dev swp31 vlan 24 master [ static | dynamic ]
 4.0.0-4.2.1 4.3.0-4.4.5
2551111
If a remote EVPN Sticky MAC [Static MAC address] is unexpectedly learned dynamically on a local interface, the selected entries in zebra and BGP are in an inconsistent state.
zebra increments the local MAC mobility sequence number and considers the MAC address to be local, but BGP maintains the remote Sticky MAC as the best path selected. This results in zebra installing the local MAC address and BGP not updating the route for the MAC address.		 4.0.0-4.4.5
2550942
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. 3.7.11-4.2.0 4.2.1-4.4.5
2550796
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero.
To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs.		 3.7.12-4.2.1 4.3.0-4.4.5
2550793
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. 3.7.12-3.7.16, 4.0.0-4.4.5
2550690
The following vulnerability has been announced that affects GnuTLS:
CVE-2020-13777: GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
Vulnerable: <= 3.6.7-4+deb10u3
Fixed: 3.6.7-4+deb10u4		 4.0.0-4.1.1 4.2.0-4.4.5
2550478
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. 3.7.7-4.2.0 4.2.1-4.4.5
2550444
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.
To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command.		 3.7.12-3.7.16, 4.0.0-4.4.5
2550443
The net show rollback description command returns an error even if the string matches a commit description.
To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead.		 3.7.12-3.7.16, 4.0.0-4.4.5
2550374
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP.

This issue is resolved in Cumulus Linux 3.7.14.		 3.7.9-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2550349
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports.
To work around this issue, restart switchd.		 3.7.10-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2550276
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.
All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent.		 3.7.12-4.2.1 4.3.0-4.4.5
2550275
If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:
May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00]
May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00]
May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE
The service starts automatically but there is an impact to POE devices momentarily.		 3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2550244
Several vulnerabilities were discovered in BIND, a DNS server implementation.
bind9-host (containing only /usr/bin/host) and some libraries from the bind9 source package are installed on the switch by default; the BIND server referred to in these vulnerabilities is not installed by default but is available in the repository for optional installation.
CVE-2019-6477: It was discovered that TCP-pipelined queries can bypass tcp-client limits resulting in denial of service.
CVE-2020-8616: It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor.
CVE-2020-8617: It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service.
Vulnerable: 9.11.5.P4+dfsg-5.1
Fixed: 9.11.5.P4+dfsg-5.1+deb10u1		 4.0.0-4.1.1 4.2.0-4.4.5
2550243
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.
To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:

#Requires=nginx.service restserver.socket
 3.7.12-3.7.16, 4.0.0-4.4.5
2550117
The following vulnerability has been announced in the apt package:
CVE-2020-3810: Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files.
Vulnerable: <= 1.8.2
Fixed: 1.8.2.1		 4.0.0-4.1.1 4.2.0-4.4.5
2549925
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:

error: swp1s1.2: netlink: cannot set link swp1s1.2 up: operation failed with ‘Network is down’ (100)
warning: cmd ‘/bin/ip addr del 10.0.0.1/24 dev eth0’ failed: returned 2 (RTNETLINK answers: Cannot assign requested address

To work around this issue, run the ifreload -a command a second time.		 3.7.12-3.7.16, 4.0.0-4.4.5
2549838
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel.
If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel.
To work around this issue, delete, then re-add the missing VNI. For example:

cumulus@switch:~$ sudo ifdown vni10100
cumulus@switch:~$ sudo ifup vni10100

If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI.		 3.7.12-4.2.1 4.3.0-4.4.5
2549782
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. 3.7.12-3.7.16, 4.0.0-4.4.5
2549712
The following vulnerability affects the openldap package:
CVE-2020-12243: A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash).
Vulnerable: <= 2.4.47+dfsg-3+deb10u1
Fixed: 2.4.47+dfsg-3+deb10u2		 4.0.0-4.1.1 4.2.0-4.4.5
2549677
After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1.
To work around this issue, revert the configuration change.		 3.7.10-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2549656
The following security vulnerabilities affect qemu packages, which are available for optional installation on Cumulus Linux:
CVE-2019-12068: In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances ’s->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
CVE-2019-15034: hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.
CVE-2019-20382: QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Vulnerable: <= 3.1+dfsg-8+deb10u4
Fixed: 3.1+dfsg-8+deb10u5		 4.0.0-4.1.1 4.2.0-4.4.5
2549472
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. 3.7.11-4.1.1 4.2.0-4.4.5
2549385
FRR incorrectly orders advertise-all-vni to be later in the configuration than manual rd or route-target definitions. This causes the rd or route-target configuration to be misapplied or not applied at all.
To work around this issue, when you manually configure the rd or route-target for a VNI, you must manually edit the /etc/frr/frr.conf file to define advertise-all-vni before the rd or route-target configuration within the l2vpn evpn address family.		 4.0.0-4.1.1 4.2.0-4.4.5
2549371
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. 3.7.11-4.3.1 4.4.0-4.4.5
2549307
The following vulnerabilities affect git, which is available in the repository for optional installation:
CVE-2020-5260: Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host.
CVE-2020-11008: Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted.		 3.7.12-4.1.1 4.2.0-4.4.5
2549225
You might see the following gport error messages in switchd.log:

2020-04-10T19:50:01.011224+09:00 E1PDX0V1ELF0001 6 switchd[925]: hal_bcm_mdb.c:530 gport 0x800007a find failed
2020-04-10T19:50:01.011631+09:00 E1PDX0V1ELF0001 6 switchd[925]: hal_bcm_mdb.c:530 gport 0x8000009 find failed

These messages are harmless and can be ignored.		 3.7.12-3.7.14.2, 4.0.0-4.4.5 3.7.15-3.7.16
2548988
On Mellanox switches, the thermal monitoring script starts in suspended mode and, as a result, the fans run at sixty percent. You also see the following log message:

hw-management.sh[847]: Thermal algorithm is manually suspend.

To work around this issue, run the following command to enable thermal monitoring:

cumulus@switch:~$ sudo echo 0 > /var/run/hw-management/config/suspend
 4.0.0-4.1.1 4.2.0-4.4.5
2548962
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. 3.7.12-4.1.1 4.2.0-4.4.5
2548930
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. 3.7.11-4.2.1 4.3.0-4.4.5
2548854
Due to a packaging error, all switches installed from the same Cumulus Linux image have the same SSH host keys. This affects switches originally installed with Cumulus Linux 4.0.0 and 4.1.0 from a disk image only (including those that were upgraded by apt to a later release).

As a result, this issue allows an attacker to more easily bypass remote host verification when a user connects by SSH to what is believed to be a previously used remote host but is really the attacker’s host. For example, this issue can be exploited by a spoofing or man-in-the-middle attack.

To resolve this issue, generate new SSH host keys for any switch that has Cumulus Linux 4.0.0 or 4.1.0 installed on it:


cumulus@switch:~$ sudo rm /etc/ssh/ssh_host*
cumulus@switch:~$ sudo dpkg-reconfigure openssh-server
cumulus@switch:~$ sudo systemctl restart ssh


After generating new SSH host keys, SSH clients that have previously logged into that switch will see a warning that the switch’s SSH host key changed; this is expected behavior. Be sure to inform anyone who may log in to the switch that you generated new SSH host keys. These users must log in to the affected switches with their SSH clients, where they will be given instructions on how to remove the old SSH host keys from the known hosts files to avoid a spoofing or man-in-the-middle attack directed at their SSH clients.

*Notes*

* This issue is fixed in Cumulus Linux 4.1.1. However, we recommend you generate new SSH host keys as this is the most reliable solution.
* If you upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later using apt-get and you didn’t generate new SSH host keys, you will need to generate new SSH host keys after the upgrade.
* If you perform a fresh install of Cumulus Linux 4.1.1 or later using a disk image, you will lose your existing local configuration.
 4.0.0-4.1.1 4.2.0-4.4.5
2548746
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. 3.7.11-4.1.1 4.2.0-4.4.5
2548674
A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact.
To work around this issue, restart FRR.		 3.7.11-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2548672
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF.
To work around this issue, remove the unnecessary eBGP IPv4 peering.		 3.7.12-3.7.15, 4.0.0-4.4.5 3.7.16
2548657
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:

W: Possible missing firmware /lib/firmware/tigon/tg3_tso5.bin for module tg3
W: Possible missing firmware /lib/firmware/tigon/tg3_tso.bin for module tg3
W: Possible missing firmware /lib/firmware/tigon/tg3.bin for module tg3

You can safely ignore these error messages.		 3.7.12-3.7.16, 4.0.0-4.4.5
2548655
When using apt-get update && apt-get upgrade to upgrade from Cumulus Linux 4.0.0 or 4.1.0 to version 4.1.1 or later, a message similar to the following may appear. 

Reading package lists… Done
E: Repository ‘http://apt.cumulusnetworks.com/repo CumulusLinux-4-latest InRelease’ changed its ‘Label’ value from ‘cumulus-repository-4.0.0’ to ‘cumulus-repository-4.1.0’
E: Repository ‘http://apt.cumulusnetworks.com/repo CumulusLinux-4-latest InRelease’ changed its ‘Codename’ value from ‘CumulusLinux-4.0.0’ to ‘CumulusLinux-4.1.0’
N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details.

To work around this issue and proceed with the upgrade, run apt-get update –allow-releaseinfo-change.		 4.0.0-4.1.0 4.1.1-4.4.5
2548579
The following security vulnerability has been announced:
CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.		 3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2548561
On the EdgeCore Minipack-AS8000, when you try to configure ROCEv2, you see errors indicating that PFC is not working properly. 4.0.0-4.1.1 4.2.0-4.4.5
2548490
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted.
To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration.		 3.7.11-4.1.1 4.2.0-4.4.5
2548485
If you configure the aggregate-address
summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:
router bgp 1
address-family ipv4 unicast
 aggregate-address 50.0.0.0/8 summary-only
exit-address-family
If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
             i internal, r RIB-failure, S Stale, R RemovedOrigin codes: i - IGP, e - EGP, ? - incomplete
  Network          Next Hop            Metric LocPrf Weight Path*> 50.0.0.0         0.0.0.0                            32768 is> 50.0.0.1/32      0.0.0.0                  0         32768 i
Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
             i internal, r RIB-failure, S Stale, R RemovedOrigin codes: i - IGP, e - EGP, ? - incomplete
  Network          Next Hop            Metric LocPrf Weight Paths> 50.0.0.1/32      0.0.0.0                  0         32768 i
To work around this issue, remove, then re-add the component prefix routes.
 3.7.12-4.2.1 4.3.0-4.4.5
2548422
You might see a core file in FRRouting related to OSPFv3 if the switch is configured as both an OSPFv3 ABR and ASBR, and other switches in the same area are also configured as both ABR and ASBR. This issue is not seen with a single ABR or ASBR in an area or if there are multiple ASBRs in an area not acting as ABRs. To work around this issue, do not perform redistribution on more than one ABR in the same area. 4.0.0-4.1.1 4.2.0-4.4.5
2548383
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. 3.7.5-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2548373
On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. 3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2548324
hostapd is not installed in Cumulus Linux 4.0.0 by default.
To work around this issue, run the following commands to install the package:

cumulus@switch:~$ sudo apt-get update -y
cumulus@switch:~$ sudo apt-get install hostapd -y
 4.0.0-4.0.1 4.1.0-4.4.5
2548320
When configuring VRF route leaking, if you define import vrf route-map but do not have any imported VRFs, the route map command displays incorrectly, and as a result, FRR fails to reload. 4.0.0-4.1.1 4.2.0-4.4.5
2548315
The following security advisory has been announced for bash:
CVE-2019-18276 Qualys scan QID 372268 setuid vulnerability
When bash or bash scripts are run setuid, bash is supposed to drop privileges, but does so incorrectly, so that an attacker with command access to the shell can use enable -f for runtime loading of a new builtin that calls setuid() to regain dropped privileges.
To work around this issue, do not make bash or bash scripts setuid.		 3.7.12-3.7.16, 4.0.0-4.4.5
2548289
When the NETQ agent is active, you see the following errors in in the FFR log file: 

2020-03-05T16:00:05.036398+09:00 [switch01][bgpd][err] [EC 100663314] Attempting to process an I/O event but for fd: 29(4) no thread to handle this!
2020-03-05T16:01:30.841455+09:00 [switch01[bgpd][err] [EC 100663314] Attempting to process an I/O event but for fd: 29(4) no thread to handle this!

You also see the following errors in the ptmd log file:

2020-03-05T15:59:12.877549+09:00 [switch01][ptmd][info] New client connection fd[17] tot[1]
2020-03-05T15:59:12.899906+09:00 [switch01][ptmd][info] Free client connection fd[17] tot[0]

You can ignore these errors.		 4.0.0-4.0.1 4.1.0-4.4.5
2548260
The net add routing route-map permit set community command does not add the set statement into the /etc/frr/frr.conf file. 4.0.0-4.4.5
2548243
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. 3.7.3-3.7.16, 4.0.0-4.4.5
2548117
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. 3.7.12-3.7.16, 4.0.0-4.4.5
2548115
The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. 3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2548113
In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. 3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2548110
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. 3.7.9-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2548044
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. 3.7.12-3.7.15, 4.0.0-4.4.5 3.7.16
2548024
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports.
swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected
To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue.		 3.7.11-4.1.1 4.2.0-4.4.5
2547942
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. 3.7.11-4.0.1 4.1.0-4.4.5
2547903
CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs
Vulnerable: 2.9.4+dfsg1-7Fixed: 2.9.4+dfsg1-7+deb10u1		 4.0.0-4.4.5
2547839
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. 3.7.11-4.1.1 4.2.0-4.4.5
2547798
An error similar to the following shows in syslog for Mellanox switches:

2020-02-12T19:59:22.208012+08:00 leaf01 sx_sdk: RM_TABLE: No resources available to add 1 entries to KVD hash Table HW resource
2020-02-12T19:59:22.208124+08:00 leaf01 sx_sdk: PORT: __port_vport_fid_set err = (No More Resources)

To work around this issue, reboot the switch.		 3.7.11-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2547783
PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. 3.7.11-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2547782
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. 3.7.11-3.7.16, 4.0.0-4.4.5
2547706
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd.
To work around this issue, reboot the switch.		 3.7.11-3.7.16, 4.0.0-4.4.5
2547667
On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. 3.7.11-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2547662
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. 3.7.8-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2547659
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. 3.7.11-4.0.1 4.1.0-4.4.5
2547610
Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work.
Mellanox switches with the Spectrum A1 ASIC do not have this issue.		 3.7.11-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2547558
On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example:
Logical swp39 controls physical swp41
Logical swp40 controls physical swp42
Logical swp43 controls physical swp45
Logical swp44 controls physical swp46
This might causes incorrect forwarding behavior.		 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547509
When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. 3.7.10-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547443
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. 3.7.11-4.0.1 4.1.0-4.4.5
2547405
When you restart the hsflowd service, you see a systemd warning message similar to the following:

Warning: The unit file, source configuration file or drop-ins of hsflowd@mgmt.service changed on disk. Run ‘systemctl daemon-reload’.
 4.0.0-4.4.5
2547360
The Mellanox SN3700C switch experiences a kernel memory leak in the bridge IPv4 multicast receive function. When IGMP snooping is disabled, received IGMP packets are cloned and the clone is not freed, causing a memory leak.
Because this memory leak is in the kernel, you cannot clear it by restarting a service; you must reboot the switch to clear the allocated memory.		 4.0.0-4.0.1 4.1.0-4.4.5
2547340
When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:

Jan 30 19:22:53 switch123 snmpd[23172]: Cannot statfs /sys/kernel/debug/tracing: Permission denied
 3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2547303
On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547292
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. 3.7.9-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2547286
NCLU crashes when you run the net add interface storage-optimized pfc command because non-ASCII quotes exist in the datapath.conf file.
To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ASCII single quotes with ASCII single quotes (standard single quote on the keyboard).		 4.0.0-4.0.1 4.1.0-4.4.5
2547266
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. 4.0.0-4.0.1 4.1.0-4.4.5
2547245
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:

RTM_NEWNEIGH with unconfigured vlan XXXX on port peerlink
 3.7.10-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2547205
On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:

Could not collect output from command: ['/usr/sbin/smonctl']

To work around this issue, run the net show system sensors json command instead.		 4.0.0-4.0.1 4.1.0-4.4.5
2547149
The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547146
The ospfd daemon might crash with the following kernel trace: 

2019-11-06T23:00:08.261749+09:00 cumulus ospfd[5339]: Assertion ‘node’ failed in file ospfd/ospf_packet.c, line 671, function ospf_write
 3.7.11-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2547128
The cumulus-overrides package contains the /etc/apt/preferences.d/20_prefer_cumulus file that pins packages from specific release names. The pinning file contains the wrong name.
To work around this issue, use the origin instead of the release name.		 4.0.0-4.0.1 4.1.0-4.4.5
2547123
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. 3.7.11-4.1.1 4.2.0-4.4.5
2547122
An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.
To work around this issue, power cycle the switch. A software reboot does not resolve the issue.		 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547120
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. 3.7.11-3.7.16, 4.0.0-4.4.5
2547118
The following security vulnerabilities have been announced in the libtiff5 library on Cumulus Linux 4.0:
CVE-2019-14973, CVE-2019-17546: Multiple integer overflows have been discovered in the libtiff library and the included tools.
Vulnerable: 4.0.10-4
Fixed: 4.1.0+git191117-2~deb10u1		 3.7.10-4.0.1 4.1.0-4.4.5
2547100
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. 3.7.11-4.1.1 4.2.0-4.4.5
2547071
On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547068
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly
To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below
To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub
3. Reboot the system with sudo reboot
To disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci3
2. Disable C-states by running the command ./cpupower idle-set -d 2
C-states are disabled by default in Cumulus Linux 4.3.0 and later.		 3.7.9-4.2.1 4.3.0-4.4.5
2547043
After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500.
To work around this issue, run ifreload -a a second time.		 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2547013
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. 3.7.7-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546991
The FRR service does not provide a way for automation to know if the configuration applied properly.
To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code.		 3.7.11-3.7.16, 4.0.0-4.4.5
2546985
On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. 3.7.10-3.7.12, 4.0.0-4.2.0 3.7.13-3.7.16, 4.2.1-4.4.5
2546951
switchd crashes when dynamic VRF route leaking is enabled and the following is true:
* The default route is leaked from VRF1 to VRF2
* Hardware-based dynamic VRF route leaking is configured (vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file).
You might see logs similar to the following in /var/log/syslog:

kernel: [159400.526241] switchd[21374]: segfault at 1229cdd84 ip 00000000004142ca sp 00007ffd557a86d0 error 4 in switchd[400000+71000]

To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF).		 3.7.10-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2546895
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:
bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!
To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.service
To increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter
2.Restart the switchd service with the sudo systemctl restart switchd.service command
systemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command.		 3.7.11-3.7.16, 4.0.0-4.4.5
2546874
On the Dell S5232F, S5248F, S5296F, and S3048 switch, using the poweroff or halt commands does not fully power off the switch. 4.0.0-4.4.5
2546869
Broadcom Field Alert - SID - MMU 2B Errors
A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop.		 3.7.0-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546739
The Mellanox SN3700C switch does not forward LLDP or LACP traffic. 4.0.0-4.0.1 4.1.0-4.4.5
2546703
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load.
To work around this issue, run the cl-support -M command to disable timeouts.		 3.7.0-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546576
A traditional bridge with QinQ and a VNI does not work for tagged traffic. 3.7.10-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2546559
On the Mellanox SN3700C switch, if you try to break out 100G switch ports into 2x50G, the configuration fails and switchd does not restart. Breaking out the ports into 4x25G works without issue. 4.0.0-4.0.1 4.1.0-4.4.5
2546502
On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. 3.7.9-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546485
The EdgeCore Minipack-AS8000 switch supports FEC RS by default; you cannot disable this setting. However, the ethtool –show-fec command output indicates that FEC is disabled. Also, if you try to change the FEC setting, Cumulus Linux reports an error. For example:

cumulus@switch:~$  net add interface swp23 link speed 100000
cumulus@switch:~$  net add interface swp23 link autoneg off
cumulus@switch:~$  net add interface swp23 link fec rs
"/sbin/ifreload -a" failed:
error: swp23: cmd ‘/sbin/ethtool –set-fec swp23 encoding rs’ failed: returned 255 (Cannot set FEC settings: Operation not supported)
Command ‘['/sbin/ifreload’, ‘-a’]' returned non-zero exit status 1
 4.0.0-4.1.1 4.2.0-4.4.5
2546454
When you run the NCLU net del all command to delete all configuration on the switch, you see an error similar to the following:

ERROR: [Errno 2] No such file or directory: ‘/cumulus/switchd/config/interface//port_security/enable’#012Traceback
 4.0.0-4.0.1 4.1.0-4.4.5
2546389
In a default VX instance, a ping to a device’s hostname fails.
To work around this issue, edit the /etc/gai.conf file and uncomment precedence ::ffff:0:0/96 10.
 4.0.0-4.0.1 4.1.0-4.4.5
2546337
The net show bridge macs command returns an empty interface column.
To work around this issue, run the bridge fdb show command to show the interface.		 4.0.0-4.1.1 4.2.0-4.4.5
2546329
A memory leak in switchd might occur, which causes switchd to restart. 3.7.10-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546265
Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.
To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command.		 3.7.10-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2546255
On the EdgeCore Minipack-AS8000 switch, a 100G DAC link does not come up when auto-negotiation is enabled on the neighbor. This switch does not support 100G DAC auto-negotiation at this time. 4.0.0-4.4.5
2546225
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support. 
 
 sudo onie-install -fai http:// 
 sudo reboot

To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image.		 3.7.11-3.7.16, 4.0.0-4.4.5
2546140
CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled.
To check if lldpd is the heavy CPU resource user, run the following command:

cumulus@switch:~$  ps -eo user,pid,ppid,cmd,%mem,%cpu –sort=-%cpu | head

Alternatively, check for messages in the /var/log/syslog directory similar to:

2020-02-20T15:02:12.137857-05:00 leaf01 sysmonitor: High CPU use: 87%
2020-02-20T15:02:12.482398-05:00 leaf01 sysmonitor:   PID USER      PR    VIRT    RES %CPU %MEM     TIME+ COMMAND
2020-02-20T15:02:12.483112-05:00 leaf01 sysmonitor:  1570 _lldpd    20   73244  13800 76.6  0.3   4:43.06 lldpd

Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.
To work around this issue, you can do one of the following:
* If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).
* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service.		 3.7.11-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2546131
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel.
To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.
This workaround only works when an out-of-band network is present.		 3.7.11-3.7.16, 4.0.0-4.4.5
2546061
Trident2+ switches do not enable DFE for 10G and 4x10G DACs. As a result, longer or marginal 10G DACs might not link up reliably.
To work around this issue, run the following command after a reboot.
On the SFP side:

echo CR > /cumulus/switchd/config/interface/swp${port}/interface_mode ; done

On the QSFP side:

echo CR > /cumulus/switchd/config/interface/swp${port}/interface_mode ; done
 4.0.0-4.0.1 4.1.0-4.4.5
2545988
When hsflowd is used on the switch, you might experience a kernel panic. 4.0.0-4.0.1 4.1.0-4.4.5
2545949
All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0.
To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version.		 3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2545933
Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.
To work around this issue, disable BFD to alleviate some of the CPU load.		 3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2545868
If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545866
After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545851
The Mellanox minimal platform module driver probe does not handle error conditions correctly.
To work around this issue, power cycle the switch.		 4.0.0-4.0.1 4.1.0-4.4.5
2545837
If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server iburst command, the /etc/ntp.conf file is misconfigured.
To work around this issue, run the net add time ntp server iburst command before you run the net add time ntp source command.		 3.7.10-3.7.11, 4.0.0-4.4.5 3.7.12-3.7.16
2545724
On the Mellanox switch with the Spectrum or Spectrum-2 ASIC, switchd might crash, then restart under certain conditions. 4.0.0-4.0.1 4.1.0-4.4.5
2545608
The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.
To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes.		 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545600
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.

[ip6tables]
-A INPUT -p tcp –dport 22 -j DROP
 3.7.2-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2545566
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. 3.7.12-4.0.1 4.1.0-4.4.5
2545536
On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. 4.0.0-4.4.5 3.7.14-3.7.16
2545520
The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. 3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2545501
On a traditional bridge, VLAN tagged traffic is not discarded when it exceeds the port security MAC limit. 4.0.0-4.0.1 4.1.0-4.4.5
2545448
The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. 3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545437
With the port security feature, if you change the number of MAC addresses allowed to access a port with the NCLU net add interface port-security mac-limit command, the net show configuration commands command might fail. 4.0.0-4.0.1 4.1.0-4.4.5
2545410
On rare occasions on a Mellanox SN3700C switch, if you insert and remove, then reinsert an AOC or QSFP28 optical transceiver quickly, port #32 might get stuck.
To avoid this issue, wait 15 seconds before insertion and before removal of the module.		 4.0.0-4.0.1 4.1.0-4.4.5
2545403
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. 3.7.10-3.7.13, 4.0.0-4.4.5 3.7.14-3.7.16
2545352
With a high number of active routes (20K or more), when you perform a networking restart, the FRR log files might become flooded with error messages associated with the restart. These logs are normal and are not directly a problem. However, the large number of messages can cause the logs to rotate away any previous history, which prevents you from tracing back events leading up to the restart. In a troubleshooting environment, this can be problematic. 4.0.0-4.1.1 4.2.0-4.4.5
2545314
The Broadcom switch with the Tomahawk3 ASIC, such as the EdgeCore Minipack AS8000, might not learn all MAC address on a port configured for bridging when the hardware MAC table is near the maximum capacity. 4.0.0-4.0.1 4.1.0-4.4.5
2545239
On the Mellanox switch with the Spectrum-2 ASIC, Precision Time Protocol (PTP) is not currently supported. 4.0.0-4.3.1 4.4.0-4.4.5
2545236
On the Edgecore AS6812 switch, you might see rare I2C errors. 3.7.2-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545233
On the Delta AG9032v1 switch, smonctl and sensors report inaccurate PSU current and power. 4.0.0-4.4.5
2545164
On the Mellanox switch with the Spectrum 2 ASIC, interfaces using 100G or 200G Direct Attach Cables (DACs) do not come up with the interface default configuration.
To work around this issue and bring the interfaces up, perform the following configuration on both sides of the link:
* Set the interface speed to the desired speed
* Set link auto-negotiation to _off_
* Set link FEC to RS mode		 4.0.0-4.1.1 4.2.0-4.4.5
2545133
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. 3.7.2-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545125
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. 3.7.10-3.7.16, 4.0.0-4.4.5
2545087
On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. 3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545054
When you run the NCLU net del interface command to delete an interface that has a description in the /etc/frr/frr.conf file but the /etc/frr/daemons file does not contain zebra=yes}, all running FRR daemons (bgpd, ospfd, ospf6d) restart
To work around this issue, remove all interfaces from the /etc/frr/frr.conf file that are unrelated to routing.		 4.0.0-4.1.1 4.2.0-4.4.5
2545049
When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2545040
On the Mellanox switch, error messages with hw-management-thermal-events.sh are displayed on shutdown. 4.0.0-4.0.1 4.1.0-4.4.5
2544978
If you delete an undefined bond, then add a bond slave, the net commit command fails. 3.7.9-3.7.16, 4.0.0-4.4.5
2544968
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:

sudo sh -c “printf ‘interface 50\nvrf TEST description L3 routing interface\n’ » /etc/frr/frr.conf”

should be:

sudo sh -c “printf ‘interface 50 vrf TEST\ndescription L3 routing interface\n’ » /etc/frr/frr.conf”

To work around this issue, configure the interface manually in the /etc/frr/frr.conf file.		 3.7.9-3.7.16, 4.0.0-4.4.5
2544957
NCLU incorrectly allows you to apply port security configuration on layer 2 and layer 3 ports that are not part of a bridge. 4.0.0-4.4.5
2544953
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.
To work around this issue, run the sudo systemctl restart lldpd.service command.		 3.7.10-3.7.16, 4.0.0-4.4.5
2544914
On the NVIDIA SN3700C switch, when you split ports from 100G to 2x50G, switchd fails to start. 4.0.0-4.0.1 4.1.0-4.4.5
2544904
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements.
To work around this issue, restart FRR after removing the IPv6 numbered configuration.		 3.7.9-4.1.1 4.2.0-4.4.5
2544880
When you run the NCLU net show commit last or net show commit command, where is the last commit, no output is shown. 4.0.0-4.4.5
2544856
In the ethool -m output, the Revision Compliance field might show Unallocated when the SFF-8363 Revision Compliance value is SFF-8636 version 2.8 or later. 4.0.0-4.1.1 4.2.0-4.4.5
2544854
On the Dell S5248F-ON switch, CPU core temp sensors may show as ABSENT. 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2544847
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. 3.7.7-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2544723
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. 3.7.6-3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2544625
VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss.
 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2544556
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:

net add time ntp server 1.2.3.4 iburst
net commit
net add time ntp server 1.2.3.4
net commit

If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options.		 3.7.9-4.1.1 4.2.0-4.4.5
2544463
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.
To work around this issue, do not use auto-negotiation and set the local port speed to 10G.		 3.7.9-3.7.16, 4.0.0-4.4.5
2544456
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. 3.7.9-3.7.16, 4.0.0-4.4.5
2544329
When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:

OSError: [Errno 24] Too many open files
 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2544311
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. 3.7.5-3.7.16, 4.0.0-4.4.5
2544213
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. 3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2544200
Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met:
* The switch is a member of an MLAG pair
* The traffic is sourced from a layer 2 adjacent host
* The host is located within a VRF of the MLAG pair
* The traffic from the source crosses the peer link
* VXLAN is configured on the MLAG pair

This issue does not impact transit traffic or traffic that does not meet all of the described conditions.
To workaround this issue, restart switchd.		 3.7.9-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2544155
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order.

3.7.5-3.7.16, 4.0.0-4.4.5
2544113
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link.
To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file.		 3.7.9-3.7.16, 4.0.0-4.4.5
2543937
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.
To work around this issue, remove the interface alias description from iproute2.		 3.7.8-3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2543900
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. 3.7.8-3.7.16, 4.0.0-4.4.5
2543841
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output.
3.7.8-3.7.16, 4.0.0-4.4.5
2543816
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages.
 3.7.6-3.7.11, 4.0.0-4.4.5 3.7.12-3.7.16
2543791
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:

2019-09-05T05:15:17.246597+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2
2019-09-05T05:15:17.274521+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/12-0053/eeprom for psu2
2019-09-05T05:15:17.469556+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/11-0050/eeprom for psu2
2019-09-05T05:15:17.497514+00:00 hp-6712-03 decode-syseeprom: Unable to find eeprom at /sys/bus/i2c/devices/12-0053/eeprom for psu2
 3.7.9-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2543781
NCLU does not allow you to configure OSPF NSSAs. For example: 

cumulus@switch:~$ net add ospf area 0.0.0.1 nssa 
ERROR: Command not found. 
net add ospf area 0.0.0.1 nssa

To work around this issue, use FRR instead. For example: 

switch# configure terminal 
switch(config)# router ospf 
switch(config-router)# area 0.0.0.1 nssa
3.7.7-3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2543724
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error: 

ERROR: ‘ascii’ codec can’t encode character u'\xe9' in position 3: ordinal not in range(128) 
See /var/log/netd.log for more details.
3.7.7-3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2543690
On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. 3.7.8-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2543649
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:

-A FORWARD -i swp5 -s 00:25:90:b2:bd:9d -d 50:6b:4b:96:c4:04 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64
 3.7.6-3.7.12, 4.0.0-4.1.1 3.7.13-3.7.16, 4.2.0-4.4.5
2543647
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:

-A FORWARD -i vni10 -j erspan –src-ip 100.1.1.2 –dst-ip 100.1.1.1 –ttl 64
 3.7.6-4.2.1 4.3.0-4.4.5
2543646
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). 3.7.6-3.7.16, 4.0.0-4.4.5
2543471
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly.
To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches.		 3.7.7-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2543401
On the Mellanox Spectrum-2 switch, the time required to establish a link (from the time a link is set to admin up until the link becomes operationally up) can take up to 15 seconds on 40G interfaces and up to 30 seconds on 100G interfaces.
To work around this issue, wait up to 15 seconds on 40G interfaces and 30 seconds on 100G interfaces for the link to establish.		 4.0.0-4.4.5
2543270
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.
To work around this issue, rely on a different source of default route other than injection with default-information originate.		 3.7.8-4.1.1 4.2.0-4.4.5
2543211
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18).
 3.7.0-3.7.16, 4.0.0-4.4.5
2543164
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.
To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command.		 3.7.7-3.7.16, 4.0.0-4.4.5
2543096
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted.
3.7.6-3.7.16, 4.0.0-4.4.5
2542979
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. 3.7.7-4.1.1 4.2.0-4.4.5
2542945
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags.
To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad: 

cumulus@switch:~$ net add bridge mybridge vlan-protocol 802.1ad
3.7.6-3.7.16, 4.0.0-4.4.5
2542872
After you issue the NCLU net del bgp vrf autonomous-system command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands.
3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2542837
On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. 3.7.6-3.7.8, 4.0.0-4.4.5 3.7.9-3.7.16
2542824
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur:
- VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts.
- VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack.

To work around this issue, either:
- Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port)
- Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers)		 3.7.5-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2542766
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl.
To work around this issue, power cycle the switch.
3.7.6-3.7.12, 4.0.0-4.4.5 3.7.13-3.7.16
2542510
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.
The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.
To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result.
In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example: 
 
ip as-path access-list MY_ASN permit ^$ 

route-map peerlink-add-asn permit 10 
match as-path MY_ASN 
set as-path prepend 4200000101 
route-map peerlink-add-asn permit 20
3.7.6-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2542305
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically.
3.7.6-3.7.16, 4.0.0-4.4.5
2542301
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted.
3.7.3-3.7.16, 4.0.0-4.4.5
2541428
When you try to change the NTP time zone with the NCLU net add time zone command or by editing the /etc/timezone file manually, the configuration does not take effect.
To work around this issue, change the time zone with the sudo timedatectl set-timezone command. For example:

cumulus@switch:~$ sudo timedatectl set-timezone US/Eastern

 4.0.0-4.0.1 4.1.0-4.4.5
2541212
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. 3.7.5-3.7.16, 4.0.0-4.4.5
2541029
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped.
This issue only affects QinQ configurations.
3.7.5-3.7.16, 4.0.0-4.4.5
2540950
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status.
 3.7.3-4.1.1 4.2.0-4.4.5
2540753
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error: 
 
ERROR: No closing quotation 
See /var/log/netd.log for more details.

3.7.5-3.7.16, 4.0.0-4.4.5
2540444
SNMP incorrectly requires engine ID specification.
3.7.4-3.7.16, 4.0.0-4.4.5
2540352
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces.
For example, this command is incorrect: 
 
net add routing route-map Proxy-ARP permit 25 match interface swp9-10

These commands are correct: 
 
net add routing route-map Proxy-ARP permit 25 match interface swp9 
net add routing route-map Proxy-ARP permit 30 match interface swp10

3.7.2-3.7.16, 4.0.0-4.4.5
2540340
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays . For example: 
 
 cumulus@switch:~$ net add vrf mgmt

Tab completion for the net add vrf ip address
command works correctly.
 3.7.4-3.7.16, 4.0.0-4.4.5
2540274
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. 3.7.5-3.7.16, 4.0.0-4.4.5
2540204
When links come up after FRR is started, VRF connected routes do not get redistributed. 3.7.4-3.7.16, 4.0.0-4.4.5
2540192
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled.
To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value.		 3.7.4-3.7.16, 4.0.0-4.4.5
2540155
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node.
3.7.3-3.7.16, 4.0.0-4.4.5
2540042
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails.
To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example: 
 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface br0.100 
switch(config-if)# vrrp 1 priority 110 
switch(config-if)# vrrp 1 advertisement-interval 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~

3.7.4-3.7.16, 4.0.0-4.4.5
2540041
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU.
To work around this issue, run the vtysh command inside FRR to change the default priority. For example: 
 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface vlan100 
switch(config-if)# vrrp 1 priority 110 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~

3.7.4-3.7.16, 4.0.0-4.4.5
2540040
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example: 
 
cumulus@switch:~$ sudo vtysh 
switch# configure terminal 
switch(config)# interface swp4 
switch(config-if)# vrrp 1 version 2 
switch(config-if)# no vrrp 1 preempt 
switch(config-if)# end 
switch# write memory 
switch# exit 
cumulus@switch:~

3.7.4-3.7.16, 4.0.0-4.4.5
2540031
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist.
3.7.3-3.7.16, 4.0.0-4.4.5
2539994
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example: 
 
cumulus@switch:~$ net del bgp neighbor fabric peer-group
‘router bgp 65001’ configuration does not have ‘neighbor fabric peer-group’

3.7.2-3.7.16, 4.0.0-4.4.5
2539962
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error.
3.7.0-3.7.16, 4.0.0-4.4.5
2539670
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type.
3.7.2-3.7.16, 4.0.0-4.4.5
2539124
The net add interface ptm-enable command adds no ptm-enable for that interface in the frr.conf file.
Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh.
3.7.2-3.7.16, 4.0.0-4.4.5
2538790
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan bridge access . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG.
To restore connectivity, remove the VLAN ID from the bridge.		 3.7.2-3.7.16, 4.0.0-4.4.5
2538590
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain.
3.7.2-3.7.16, 4.0.0-4.4.5
2538562
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.
After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.
To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings.
Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G.		 3.7.2-3.7.16, 4.0.0-4.4.5
2538294
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. 3.7.0-3.7.16, 4.0.0-4.4.5
2538256
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets.
3.7.2-4.0.1 4.1.0-4.4.5
2537699
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces: 
 
2018-11-10T23:35:30.992370-08:00 Dev dhcrelay: Listening on LPF/vlan.101/a0:00:00:00:00:51 
2018-11-10T23:35:30.993472-08:00 Dev dhcrelay: Sending on LPF/vlan.101/a0:00:00:00:00:51

Eventually the dhcrelay service stops.
3.7.1-3.7.16, 4.0.0-4.4.5
2537544
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. 3.7.1-3.7.16, 4.0.0-4.4.5
2537061
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent.
3.7.1-4.0.1 4.1.0-4.4.5
2536617
CVE-2018-5391 (FragmentSmack) is a network vulnerability where an attacker can trigger time and calculation expensive fragment reassembly with specially crafted packets, leading to a denial of service. On a Cumulus Linux switch, the impact is limited to control plane and management plane traffic. Any control plane traffic coming in the front panel ports will be limited by existing policer ACLs.
To work around this issue, create a file called /etc/sysctl.d/ip.conf and add these settings:

net.ipv4.ipfrag_low_thresh = 196608
net.ipv6.ip6frag_low_thresh = 196608
net.ipv4.ipfrag_high_thresh = 262144
net.ipv6.ip6frag_high_thresh = 262144
 3.7.0-3.7.11, 4.0.0-4.0.1 3.7.12-3.7.16, 4.1.0-4.4.5
2536576
If you try to bring down several members of a bond remotely at the same time, the link state of one of the interfaces might not transition correctly to the down state; however, all links show down in hardware.
4.0.0-4.4.5
2536384
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware.
3.7.0-3.7.16, 4.0.0-4.4.5
2536256
For an unresolved address, the IPROUTER default policer rule has been modified to not match on packets exiting a TUNNEL and headed to the CPU to resolve the address via ARP. As a result, the following default rule no longer matches TUNNEL ingress packets. 
 
A $INGRESS_CHAIN –in-interface $INGRESS_INTF -m addrtype –dst-type 
IPROUTER -j POLICE –set-mode pkt –set-rate 400 –set-burst 100

These packets are now policed by catch all rules.
To work around this issue, the VPORT value on a TRIDENT switch must be changed from binary 011 to 100.
4.0.0-4.4.5
2536242
On the EdgeCore AS7712 (Tomahawk) switch running in atomic mode, when a layer 3 ECMP path is brought down, traffic traversing the path stops working for about four seconds. When the switch is changed to non-atomic mode, the delay is less than one second. This issue is seen across OSPF and static ECMP routes. 4.0.0-4.4.5
2536231
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature.
In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic.		 3.7.3-3.7.10, 4.0.0-4.0.1 3.7.11-3.7.16, 4.1.0-4.4.5
2536179
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. 3.7.0-3.7.16, 4.0.0-4.4.5
2535986
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.
When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart.		 3.7.0-3.7.16, 4.0.0-4.4.5
2535965
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly.
To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic.		 3.7.0-3.7.16, 4.0.0-4.4.5
2535844
On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead.
-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100
To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets:
-A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100
Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done.		 4.0.0-4.4.5 3.7.13-3.7.16
2535723
The source address of the ICMPv6 time exceeded message (traceroute hop) is sourced from the wrong VRF when the traceroute target resides on the same switch but in a different VRF. 4.0.0-4.4.5
2535706
On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. 4.0.0-4.4.5 3.7.14-3.7.16
2535605
FRR does not add BGP ttl-security to either the running configuration or to the /etc/frr/frr.conf file when configured on a peer group instead of a specific neighbor.
To work around this issue, add ttl-security to individual neighbors instead of the peer group.		 4.0.0-4.4.5
2535209
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.
To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment.		 3.7.5-3.7.10, 4.0.0-4.4.5 3.7.11-3.7.16
2534977
On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. 4.0.0-4.4.5 3.7.14-3.7.16
2534734
Span rules matching the out-interface as a bond do not mirror packets. 4.0.0-4.4.5
2533691
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict.
To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface.		 3.7.12-3.7.16, 4.0.0-4.4.5
2533625
PIM and MSDP entries are set to the internal COS value of 6 so they are grouped together with the bulk traffic priority group in the default traffic.conf file. However, PIM, IGMP, and MSDP are considered control-plane and should be set to the internal COS value of 7. 4.0.0-4.4.5
2533337
When you use NCLU to bring a bond admin down (net add bond link down), the bond interface goes into admin down state but the switch ports enslaved to the bond remain UP. If you are using bond-lacp-bypass-allow or balance-xor mode, the host might continue to send traffic. This traffic will be dropped because although the bond slaves are UP, they are not members of the bridge.
To work around this issue, use the sudo ifdown command.		 4.0.0-4.4.5
2532017
In FRR, bgp_snmp does not show all BGP peers when peer groups used. 3.7.11-4.0.1 4.1.0-4.4.5
2531273
In certain cases, a peer device sends an ARP request from a source IP address that is not on the connected subnet and the switch creates a STALE neighbor entry. Eventually, the switch attempts to keep the entry fresh and sends ARP requests to the host. If the host responds, the switch has REACHABLE neighbor entries for hosts that are not on the connected subnet.
To work around this issue, change the value of arp_ignore to 2. See [Address Resolution Protocol in the Cumulus Linux user guide|https://docs.cumulusnetworks.com/cumulus-linux/Layer-3/Address-Resolution-Protocol-ARP/] for more information.		 4.0.0-4.4.5

Fixed Issues in 4.0.0

Issue ID Description Affects
2656291
The following CVEs affect the linux kernel package:
CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
For the detailed security status of linux, refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux		 3.7.12-3.7.16
2555277
When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. 3.7.13-3.7.14.2
2552383
The following security vulnerability has been announced in net-snmp:
CVE-2020-15681: A privilege escalation vulnerability was discovered in Net-SNMP due to incorrect symlink handling.
Vulnerable: <= 5.8.0-cl3u10
Fixed: 5.8.0-cl3u11, 5.8.0-cl4u4		 3.7.6
2551554
Customers running security scans on Cumulus Linux 4 may encounter the listing of an incorrect version of u-boot 2014.10+dfsg1-4 with the following vulnerabilities:CVE-2017-3225CVE-2017-3226CVE-2018-18440CVE-2019-11690CVE-2019-13103CVE-2019-14192CVE-2019-14193CVE-2019-14194CVE-2019-14195CVE-2019-14196CVE-2019-14197CVE-2019-14198CVE-2019-14199CVE-2019-14200CVE-2019-14201CVE-2019-14202CVE-2019-14203CVE-2019-14204CVE-2020-10648The u-boot-tools package is not installed on the switch by default, but is available in the repository for optional installation. On Cumulus Linux 4, the version is at least 2019.01+dfsg-7. However, the older versions available for optional installation on Cumulus Linux 3 may be vulnerable
According to https://security-tracker.debian.org/tracker/source-package/u-boot , all except the following are fixed in 2019.01+dfsg-7:CVE-2017-3225: https://security-tracker.debian.org/tracker/CVE-2017-3225 says “Negligible security impact”
CVE-2017-3226: https://security-tracker.debian.org/tracker/CVE-2017-3226 says “Negligible security impact”
CVE-2018-18440: https://security-tracker.debian.org/tracker/CVE-2018-18440 says “No security impact as supported/packaged in Debian”.		 3.7.12-3.7.16
2551288
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.
To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file.		 3.7.7-3.7.16
2550322
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised.
To work around this issue, recreate the neighbor entry and flap the interface to the host.
Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry.		 3.7.3-3.7.12
2549396
When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. 3.7.12
2548474
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI.
To work around this issue, reboot the leaf switch or restart switchd.		 3.7.6-3.7.13
2548191
A security scanner may detect a version of wpa or hostapd that is not listed as having been fixed for CVE-2019-13377 and/or CVE-2019-16275. Cumulus Linux since 3.7.9 and 4.0.0 has a customized version of wpa and hostapd which includes the fixes for these vulnerabilities. 3.7.8
2548155
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. 3.7.10-3.7.16
2547381
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:

Dec 20 08:43:27 netflow-nms sfcapd[3991]: SFLOW: readFlowSample_header() undefined headerProtocol = 0

 3.7.11-3.7.16
2547349
When you change an interface IP address, then change it back, static routes are misprogrammed
One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR		 3.7.11-3.7.16
2545562
The following Linux kernel security vulnerabilities do not affect Cumulus Linux in supported configurations:
CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135
Several vulnerabilities have been discovered in the Linux kernel that may may to a privilege escalation, denial of service, or information leak.
CVE-2018-12207: Intel CPU hypervisor vulnerability. Running hypervisors on Cumulus Linux is not supported.
CVE-2019-0154, CVE-2019-0155: Intel GPU vulnerabilities. GPUs are not present on our switches.
CVE-2019-11135, CVE-2019-11139: Intel CPU transactional memory vulnerability. None of our switches support transactional memory.
For the detailed security status of linux, refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux
2545192
switchd does not program multicast routes 224/8 into hardware. 3.7.9-3.7.10
2544866
Package: tcpdump
CVE ID: CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462
CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466
CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470
CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882
CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230
CVE-2018-16300 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166
Several vulnerabilities have been discovered in tcpdump, a command-line
network traffic analyzer. These vulnerabilities might result in denial of
service or, potentially, execution of arbitrary code.
For the detailed security status of tcpdump, refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tcpdump
Fixed versions: 4.9.3-1~deb10u1 on Cumulus Linux 4, 4.9.3-1~deb8u1 on Cumulus Linux 3.		 3.7.10
2544814
If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. 3.7.10
2544671
Package : sudoCVE ID : CVE-2019-14287Debian Bug : 942322Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access
Details can be found in the upstream advisory at https://www.sudo.ws/alerts/minus_1_uid.html
We recommend that you upgrade your sudo packages. For the detailed security status of sudo please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sudoVulnerable versions: < 1.8.27-1+deb10u1Fixed versions: >= 1.8.27-1+deb10u1To work around this iisue, disable (comment out) any sudoers entries in /etc/sudoers or files in /etc/sudoers.d that have entries with !root in them. Only root or other users with a uid of 0 that are affected.		 3.7.9-3.7.16
2544608
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. 3.7.7-3.7.10
2544558
When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. 3.7.8-3.7.10
2544400
Package: openssl
CVE ID: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563
Three security issues were discovered in OpenSSL: A timing attack against
ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey()
and it was discovered that a feature of the random number generator (RNG)
intended to protect against shared RNG state between parent and child
processes in the event of a fork() syscall was not used by default.
Fixed version: 1.1.1d-0+deb10u1
We recommend that you upgrade your openssl packages.
For the detailed security status of openssl, refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openssl		 3.7.0-3.7.10
2544323
Package: hostapd
CVE ID: CVE-2019-13377 CVE-2019-16275
Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point).
CVE-2019-13377
A timing-based side-channel attack against WPA3’s Dragonfly handshake when using Brainpool curves could be used by an attacker to retrieve the password.
CVE-2019-16275
Insufficient source address validation for some received Management frames in hostapd could lead to a denial of service for stations associated to an access point. An attacker in radio range of the access point could inject a specially constructed unauthenticated IEEE 802.11 frame to the access point to cause associated stations to be disconnected and require a reconnection to the network.
Fixed version: 1:2.8.0-cl4u3		 3.7.0-3.7.10
2543874
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. 3.7.6-3.7.10
2543800
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface.
3.7.8-3.7.16
2543726
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).

-A FORWARD -i swp+ -j LOG
-A FORWARD -i swp+ -j DROP

You can now install such rules with swp+.		 3.7.3-3.7.10
2543707
Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform.
3.7.9-3.7.10
2543664
clagd memory consumption increases under certain unknown conditions.
3.7.8-3.7.10
2543637
Package: linux
CVE ID: CVE-2018-20836 CVE-2019-1125 CVE-2019-1999 CVE-2019-10207 CVE-2019-10638 CVE-2019-12817 CVE-2019-12984 CVE-2019-13233 CVE-2019-13631 CVE-2019-13648 CVE-2019-14283 CVE-2019-14284
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
For the 4.0.0 release, these problems have been fixed in version 4.19.76-1+cl4u1
For the detailed security status of linux, refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux
2543627
Tomahawk 40G DACs cannot disable auto-negotiation. 3.7.7-3.7.16
2543373
After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. 3.7.8-3.7.10
2543324
Lenovo switches do not send or receive LLDP on eth0 interfaces. 3.7.7-3.7.10
2543112
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh.
3.7.3-3.7.10
2543058
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces.
To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces.		 3.7.7-3.7.16
2543052
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR.
To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:

ifdown vlan123 ; sleep 2 ; ifup vlan123

You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI.		 3.7.5-3.7.16
2543044
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up.
You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up.		 3.7.2-3.7.16
2542966
A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues.
2542957
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. 3.7.7-3.7.10
2542939
When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. 3.7.8
2542912
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. 3.7.6-3.7.10
2542834
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. 3.7.4-3.7.10
2542820
On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. 3.7.7-3.7.8
2542383
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF.
To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command.
3.7.6-3.7.10
2542339
In a typical CLOS network, each leaf is connected to all spine nodes; VXLAN packets follow leaf-spine links. However certain failure scenarios or maintenance activity might result in the MLAG primary switch being isolated from the spine layer (the only available network path is now across the peer link). As a result, the MLAG primary switch fails to transmit VXLAN encapsulated packets out on the peer link. It is also possible for the MLAG secondary switch to be isolated from the spine layer and then the problem is seen on the MLAG secondary switch.
The issue occurs because the Broadcom Trident3 switch does not perform VLAN translation for VXLAN encapsulated packets where the tunnel is not terminated.
To work around this issue, configure the BGP peering on a new VLAN interface (for example, vlan4093) instead of the peer link sub-interface (peerlink.4094).
3.7.6
2542247
When you generate a cl-support file, clagd.service prints log messages similar to the following: 
 
 019-03-21T07:18:15.727581+00:00 leaf01 clagd[20912]: DumpThreadStacks - start 
 2019-03-21T07:18:15.728157+00:00 leaf01 clagd[20912]: #012thread: CollectSysInfo (140608446367488) 
 2019-03-21T07:18:15.735986+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 783, in __bootstrap 
 2019-03-21T07:18:15.736585+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 810, in __bootstrap_inner 
 2019-03-21T07:18:15.737045+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 763, in run 
 2019-03-21T07:18:15.737933+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 930, in CollectSysInfoT 
 2019-03-21T07:18:15.739527+00:00 leaf01 clagd[20912]: file: /usr/sbin/clagd, line 187, in CollectSysInfo 
 2019-03-21T07:18:15.740540+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/threading.py, line 621, in wait 
 2019-03-21T07:18:15.742293+00:00 leaf01 clagd[20912]: file: /usr/lib/python2.7/dist-packages/clag/clagthread.py, line 48, in wait 
 . 
 . 
 2019-03-21T07:18:16.456061+00:00 leaf01 clagd[20912]: DumpThreadStacks - end

3.7.6-3.7.10
2542099
On the EdgeCore AS7816 switch, PCIE errors cause switchd startup to fail. 3.7.9-3.7.10
2541441
The following CVEs were announced in Debian Security Advisory DSA-444-1, DSA-4447-1 and affect the linux kernel and microcode.
Package: linux
CVE ID: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091
Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers).
This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory.
See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.
To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. Contact your hardware ndor for microcode uppdates.
In addition, this update includes a fix for a regression causing deadlocks inside the loopback driver.
Fixed in version 4.19.76-1+cl4u1
2541005
NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error: 
 
cumulus@leaf01$ net del bgp neighbor swp5 interface peer-group spine 
‘router bgp 65001’ configuration does not have ‘neighbor swp5 interface peer-group spine’
3.7.7-3.7.8
2540685
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. 3.7.3-3.7.8
2540601
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. 3.7.3-3.7.8
2539081
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table.
To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command.
3.7.0-3.7.16
2538345
In an EVPN symmetric routing deployment with active-active anycast IP configured, the next hop attribute is sometimes set to a unique address instead of the anycast IP address.
To work around this issue, do not use default-originate ipv4; instead configure the network statements (recommended for small scale deployments).
3.7.2
2537820
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none.
3.7.2-3.7.16
2537535
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. 3.7.5-3.7.10
2537104
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL.
3.7.1-3.7.16
2536651
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters).
While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform.		 3.7.0-3.7.8
2536638
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0.
To work around this issue:
* If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000).
* If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file.		 3.7.0-3.7.10
2534982
The advertised routes list may be empty for an EVPN peering even though the remote switch reports received routes.
2534449
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. 3.7.0-3.7.10
2534039
On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed.
2532396
Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics.
2531343
When sFlow is enabled, some sampled packets, such as IPMC, are forwarded twice (in the ASIC and then again through the kernel networking stack).
2529321
On a Mellanox switch in an MLAG configuration, routed packets that arrive on one switch to be forwarded to a destination MAC across the peer link are dropped due to MLAG loop prevention. This affects both routed unicast and multicast packets.

To work around this issue, modify the routing design or policy such that routes do not have a next hop of an MLAG peer switch that traverses the MLAG peer link.
2528800
Counter samples for an 80G bond (2 x 40G) exported from the switch show an interface speed (ifSpeed) of 14.464Gbps.

    Copyright © 2024  NVIDIA Corporation