VyOS Networks Blog

Hello, Community!

VyOS 1.3.7/Equuleus maintenance release is available now. It fixes the buffer overflow vulnerability recently discovered in GNU libc (CVE-2024-2961). It also adds a few useful options, such as startup resync in conntrack-sync and multiple peers for unicast VRRP; improves PPPoE server syntax to allow PADO delay of zero and client pools with arbitrary subnet masks; and fixes a bunch of bugs, including a bug that prevented BGP RPKI from loading correctly. Read on for details!

Security

• T6324: CVE-2024-2961 (iconv buffer overflow in glibc)

New features and improvements

• T1244: Add support for StartupResync in conntrack-sync
• T5364: Make it possible to set the PADO delay to 0
• T5418: Allow arbitrary subnets in PPPoE client IP pools
• T5504: Make it possible to set more than one peer-address in unicast VRRP
• T6057: Add ability to disable syslog for conntrackd

Bug fixes

• T1751: DNS server addresses from DHCPv6 are not added to resolv.conf
• T1976: deleting address-family under neighbor will disable neighbor
• T2044: RPKI doesn't boot properly
• T2113: OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping
• T2279: Router resolves as 127.0.1.1 when using Router's Recursive DNS
• T2590: DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c
• T2612: HTTPS API, changing API key fails but goes through
• T2801: conntrack-tools flooding logs
• T2998: SNMP v3 oid "exclude" option doesn't work
• T3437: BGP Confederation Addition Causes Error
• T3992: Unhandled exception when trying to add an interface with an assigned address to a bridge
• T4270: When "ignore-hosts-file" is unset, local hostname of the router resolves to 127.0.1.1 in the DNS forwarding service
• T4453: dhclient fails to renew DHCP lease with VRF
• T5239: Host name and domain name missing from the FRR configuration
• T5982: Isolated interfaces smoketest fail
• T6004: Missing RPKI boot priority prevents it from loading
• T6056: Applying 'system static-host-mapping' command calls unnecessary snmpd restart
• T6088: Configuration corrupted after saving and powercut or force reboot
• T6096: Config commits are not synced properly because 00vyos-sync is deleted by vyos-router
• T6110: Insufficient validation of range option with failover in DHCP server
• T6124: Docker equuleus build image doesn't build due to fpm
• T6141: Trying to set PADO delay in PPPoE server without also configuring the session options causes a commit failure
• T6150: Impossible to set a static IP address via RADIUS in IPoE
• T6193: dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces
• T6196: Route-map and summary-only do not work in BGP aggregation at the same time
• T6243: Update vyos-http-api-tools for package idna security advisory

Other resolved issues

• T1198: Extra hyphen in suggested image name on upgrade
• T6261: Typo in the operational mode connect and disconnect command output