SUSE-RU-2024:0781-1: Recommended update for cloud-netconfig
This update for cloud-netconfig fixes the following issues: Add Provides/Obsoletes for dropped cloud-netconfig-nm Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions
Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory
Update to version 1.11:
Revert address metadata lookup in GCE to local lookup (bsc#1219454) Fix hang on warning log messages Check whether getting IPv4 addresses from metadata failed and abort if true Only delete policy rules if they exist Skip adding/removing IPv4 ranges if metdata lookup failed Improve error handling and logging in Azure Set SCRIPTDIR when installing netconfig wrapper
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/cloud-netconfig-ec2to a version that resolves this vulnerability.Fixed in 1.11-150000.25.17.1 - Upgrade
Upgrade
suse/cloud-netconfig-gceto a version that resolves this vulnerability.Fixed in 1.11-150000.25.17.1 - Upgrade
Upgrade
suse/cloud-netconfig-azureto a version that resolves this vulnerability.Fixed in 1.11-150000.25.17.1 - Upgrade
Upgrade
cloud-netconfigto a version that resolves this vulnerability.Fixed in 1.11
Event History
Frequently Asked Questions
Which environments are covered by this update?
The update covers cloud-netconfig packages for EC2, GCE, and Azure on openSUSE Leap Micro 5.3 and 5.4, openSUSE Leap 15.5, SUSE Linux Enterprise Micro 5.3, and SUSE Linux Enterprise Micro for Rancher 5.3.
What operational symptoms can indicate a system needs this update?
Relevant symptoms include hangs when warning log messages are generated, failures obtaining IPv4 addresses from cloud metadata, and incorrect handling of IPv4 ranges or policy rules after metadata lookup failures. Azure-related error handling and logging are also updated.
What cloud-specific behavior is changed?
For GCE, address metadata lookup is reverted to a local lookup. The update also aborts when IPv4 metadata retrieval fails, avoids adding or removing IPv4 ranges when that lookup fails, and deletes policy rules only when they exist.