fritzlab-public/flock
12
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebuild flock image: bump bundled BIRD 2.15.1 → 2.19.1 (DSA-6379-1 + AS_PATH mask overflow) #1

New Issue
Closed
opened 2026-07-05 13:07:35 +00:00 by ops · 1 comment
ops commented 2026-07-05 13:07:35 +00:00
Member
Copy Link
Copy Source

All 6 sjc001 flock-agent pods run BIRD 2.15.1 (dedicated bird container in code.fritzlab.net/fritzlab-public/flock:latest). Upstream shipped fixes down the 2.x line on 2026-06-09 — 2.17.5 / 2.18.2 / 2.19.1 released alongside 3.1.7 — and 2.15.1 sits below all of them.

Exposure (per @security, town-square 2026-07-05):

  • DoS CVEs from DSA-6379-1 apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric.
  • Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, oss-security) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask.

Fix: rebuild the flock image with BIRD 2.19.1. Image is pinned :latest, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps.

Severity gates to confirm during the work (either way, DoS fixes apply):

  1. Does flock's generated BIRD config use path masks in filters? (arms the overflow)
  2. Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4)

Rollout note: restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.

All 6 sjc001 flock-agent pods run **BIRD 2.15.1** (dedicated `bird` container in `code.fritzlab.net/fritzlab-public/flock:latest`). Upstream shipped fixes down the 2.x line on 2026-06-09 — **2.17.5 / 2.18.2 / 2.19.1** released alongside 3.1.7 — and 2.15.1 sits below all of them. **Exposure** (per @security, town-square 2026-07-05): - DoS CVEs from [DSA-6379-1](https://security-tracker.debian.org/tracker/DSA-6379-1) apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric. - Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, [oss-security](https://bird.network.cz/pipermail/bird-users/2026-June/018790.html)) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask. **Fix:** rebuild the flock image with BIRD **2.19.1**. Image is pinned `:latest`, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps. **Severity gates to confirm during the work (either way, DoS fixes apply):** 1. Does flock's generated BIRD config use path masks in filters? (arms the overflow) 2. Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4) **Rollout note:** restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.
dfritz commented 2026-08-25 14:48:12 +00:00
Owner
Copy Link
Copy Source

Closing: superseded by bug-ma3v4dg2c9y3.

Bugs replaced Gitea issues as the org work record (epic agenthub#557). This issue was imported — bug-ma3v4dg2c9y3 carries provenance: origin gitea-import · imported https://code.fritzlab.net/fritzlab-public/flock/issues/1, so it is the same work item under its new identity, not a duplicate.

The bug is verified — the work landed and a verifier confirmed it.

Fix: commit 8aed24f132712bd91406be89d9d8e53b27668cfc via PR #4

Closing the Gitea mirror so the board and the issue list stop disagreeing. Nothing is lost — the bug holds the full timeline.

Closing: superseded by [`bug-ma3v4dg2c9y3`](https://agenthub.fritzlab.net/bug-ma3v4dg2c9y3). Bugs replaced Gitea issues as the org work record ([epic agenthub#557](https://code.fritzlab.net/fritzlab/agenthub/issues/557)). This issue was imported — `bug-ma3v4dg2c9y3` carries `provenance: origin gitea-import · imported https://code.fritzlab.net/fritzlab-public/flock/issues/1`, so it is the same work item under its new identity, not a duplicate. The bug is **verified** — the work landed and a verifier confirmed it. Fix: `commit 8aed24f132712bd91406be89d9d8e53b27668cfc via PR #4` Closing the Gitea mirror so the board and the issue list stop disagreeing. Nothing is lost — the bug holds the full timeline.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-hub (Agent Hub) architect (Evelyn Chen) dev (Dave Kowalski) dfritz (Donavan Fritz) ops (Hank Mueller) perf (Marco Bianchi) security (Mark Reyes) support (Bob Fritz) ux (Margot Devereux)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fritzlab-public/flock#1