Rebuild flock image: bump bundled BIRD 2.15.1 → 2.19.1 (DSA-6379-1 + AS_PATH mask overflow) #1

New Issue

2026-07-05T13:07:35Z

ops commented

2026-07-05 13:07:35 +00:00

All 6 sjc001 flock-agent pods run BIRD 2.15.1 (dedicated bird container in code.fritzlab.net/fritzlab-public/flock:latest). Upstream shipped fixes down the 2.x line on 2026-06-09 — 2.17.5 / 2.18.2 / 2.19.1 released alongside 3.1.7 — and 2.15.1 sits below all of them.

Exposure (per @security, town-square 2026-07-05):

DoS CVEs from DSA-6379-1 apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric.
Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, oss-security) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask.

Fix: rebuild the flock image with BIRD 2.19.1. Image is pinned :latest, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps.

Severity gates to confirm during the work (either way, DoS fixes apply):

Does flock's generated BIRD config use path masks in filters? (arms the overflow)
Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4)

Rollout note: restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.

All 6 sjc001 flock-agent pods run **BIRD 2.15.1** (dedicated `bird` container in `code.fritzlab.net/fritzlab-public/flock:latest`). Upstream shipped fixes down the 2.x line on 2026-06-09 — **2.17.5 / 2.18.2 / 2.19.1** released alongside 3.1.7 — and 2.15.1 sits below all of them. **Exposure** (per @security, town-square 2026-07-05): - DoS CVEs from [DSA-6379-1](https://security-tracker.debian.org/tracker/DSA-6379-1) apply to the 2.x branch — a BIRD crash drops that node's routes off the BGP fabric. - Worse: stack buffer overflow in BGP AS_PATH mask matching (CVE pending, [oss-security](https://bird.network.cz/pipermail/bird-users/2026-June/018790.html)) — a peer sending a gargantuan AS path can crash and possibly exec code in the daemon holding the BGP session, IF a filter uses a path mask. **Fix:** rebuild the flock image with BIRD **2.19.1**. Image is pinned `:latest`, so this is a rebuild + repush in this repo, then a rolling restart of the flock-agent DaemonSet — not a manifest tag bump in apps. **Severity gates to confirm during the work (either way, DoS fixes apply):** 1. Does flock's generated BIRD config use path masks in filters? (arms the overflow) 2. Is 179/tcp on nodes reachable beyond mesh peers? (should be mesh-peers-only on the routed fabric — confirm, IPv6 and IPv4) **Rollout note:** restart one node's flock-agent at a time and verify BGP sessions re-establish + routes converge before the next — same one-node-at-a-time shape as apps#74.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: fritzlab-public/flock#1