Security update for nebula
This update for nebula fixes the following issues: Changes in nebula: - Update to version 1.10.3: * Fix an issue where blocklist bypass is possible when using curve P256 Any newly issued P256 based certificates will have their signature clamped to the low-s form. Nebula will assert the low-s signature form when validating certificates in a future version - Update to version 1.10.2: * Fix panic when using use_system_route_table - Update to version 1.10.1: * Fix a bug where an unsafe route derived from the system route table could be lost on a config reload * Fix the PEM banner for ECDSA P256 public keys * Fix a bug in handshake processing when a peer sends an unexpected public key * Add a config option to control accepting recv_error packets which defaults to always - Update to version 1.10.0: * Support for ipv6 and multiple ipv4/6 addresses in the overlay * Add the ability to mark packets on linux to better target nebula packets in iptables/nftables * Add ECMP support for unsafe_routes * PKCS11 support for P256 keys when built with pkcs11 tag * default_local_cidr_any now defaults to false * Improve logging when a relay is in use on an inbound packet * Avoid fatal errors if rountines is > 1 on systems that <= 1 * Log a warning if a firewall rule contains an any that negates a more restrictive filter * Accept encrypted CA passphrase from an environment variable * Allow handshaking with any trusted remote * Log only the count of blocklisted certificate fingerprints instead of the entire list * Don't fatal when the ssh server is unable to be configured successfully * Improve lost packet statistics * Honor remote_allow_list in hole punch response - remove patch fix-CVE-2025-22869.patch, fixed upstream - update to version 1.9.7: * Disable sending recv_error messages when a packet is received outside the allowable counter window * Improve error messages and remove some unnecessary fatal conditions in the generic udp listener - update to version 1.9.6: * Support dropping inactive tunnels. This is disabled by default * Ensure the same relay tunnel is always used when multiple relay tunnels are present * Fix relay migration panic
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for nebula fixes the following issues: Changes in nebula: - Update to version 1.10.3: * Fix an issue where blocklist bypass is possible when using curve P256 Any newly issued P256 based certificates will have their signature clamped to the low-s form. Nebula will assert the low-s signature form when validating certificates in a future version - Update to version 1.10.2: * Fix panic when using use_system_route_table - Update to version 1.10.1: * Fix a bug where an unsafe route derived from the system route table could be lost on a config reload * Fix the PEM banner for ECDSA P256 public keys * Fix a bug in handshake processing when a peer sends an unexpected public key * Add a config option to control accepting recv_error packets which defaults to always - Update to version 1.10.0: * Support for ipv6 and multiple ipv4/6 addresses in the overlay * Add the ability to mark packets on linux to better target nebula packets in iptables/nftables * Add ECMP support for unsafe_routes * PKCS11 support for P256 keys when built with pkcs11 tag * default_local_cidr_any now defaults to false * Improve logging when a relay is in use on an inbound packet * Avoid fatal errors if rountines is > 1 on systems that <= 1 * Log a warning if a firewall rule contains an any that negates a more restrictive filter * Accept encrypted CA passphrase from an environment variable * Allow handshaking with any trusted remote * Log only the count of blocklisted certificate fingerprints instead of the entire list * Don't fatal when the ssh server is unable to be configured successfully * Improve lost packet statistics * Honor remote_allow_list in hole punch response - remove patch fix-CVE-2025-22869.patch, fixed upstream - update to version 1.9.7: * Disable sending recv_error messages when a packet is received outside the allowable counter window * Improve error messages and remove some unnecessary fatal conditions in the generic udp listener - update to version 1.9.6: * Support dropping inactive tunnels. This is disabled by default * Ensure the same relay tunnel is always used when multiple relay tunnels are present * Fix relay migration panic
05 / REFERENCES