# Flatcar Container Linux Release - 2022-11-01

The tests look good, only the K8s 1.22 Cilium 0.13rc0 combination didn't work but that's not on our side.

## Stable 3227.2.4

- AMD64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: none
- ARM64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: all

VERDICT: _GO_ / _WAIT_ / _NO-GO_

## Beta 3374.1.1

- AMD64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: none
- ARM64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: all

VERDICT: _GO_ / _WAIT_ / _NO-GO_

## Alpha 3402.0.1

- AMD64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: all
- ARM64-usr
- Platforms succeeded: all
- Platforms failed: all: kubeadm.v1.22.7.cilium.*.base
- Platforms not tested: all

VERDICT: _GO_ / _WAIT_ / _NO-GO_

## Communication

---

#### Guidelines / Things to Remember

- Release notes are used in a PR and will appear on https://www.flatcar-linux.org/releases/
- [Announcement Message](#Announcement-Message) is posted in [Flatcar-Linux-user](https://groups.google.com/g/flatcar-linux-user). Make sure to post as “Flatcar Container Linux User”, not with your personal user (this can be selected when drafting the post).
- Make sure the the LTS is referred to as `LTS-2021`, and not `LTS-2605`
---

### Announcement Message

Subject: Announcing new releases Stable 3227.2.4, Beta 3374.1.1, Alpha 3402.0.1

Hello,
We are pleased to announce a new Flatcar Container Linux Security release for the Stable, Beta, and Alpha channel. This release is a minimal patch release. It does not introduce any changes apart from an OpenSSL security fix (and an OpenStack-only bugfix for Stable).

New **Stable** Release **3227.2.4**

_Changes since **Stable 3227.2.3**_

#### Security fixes:
- OpenSSL ([CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602), [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786))

#### Changes:
- OpenStack: enabled `coreos-metadata-sshkeys@.service` to provision SSH keys from metadata. ([Flatcar#817](https://github.com/flatcar/Flatcar/issues/817), [coreos-overlay#2246](https://github.com/flatcar/coreos-overlay/pull/2246))

#### Updates:
- ca-certificates ([3.84](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_84.html))

New **Beta** Release **3374.1.1**

_Changes since **Beta 3374.1.0**_

#### Security fixes:
- OpenSSL ([CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602), [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786))

New **Alpha** Release **3402.0.1**

_Changes since **Alpha 3402.0.0**_

#### Security fixes:
- OpenSSL ([CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602), [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786))

Best,
The Flatcar Container Linux Maintainers

---
### Security

**Subject**: Security issues fixed with the latest Stable 3227.2.4, Beta 3374.1.1, Alpha 3402.0.1 release(s)

**Security fix**: With the Stable 3227.2.4, Beta 3374.1.1, Alpha 3402.0.1 releases we ship fixes for the CVEs listed below.

#### Stable 3227.2.4
- OpenSSL
- [CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer
overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate
against the risk of remote code execution. The risk may be further
mitigated based on stack layout for any given platform/compiler.
Pre-announcements of CVE-2022-3602 described this issue as CRITICAL.
Further analysis based on some of the mitigating factors described above
have led this to be downgraded to HIGH. Users are still encouraged to
upgrade to a new version as soon as possible.
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

- [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.' character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

#### Beta 3374.1.1
- OpenSSL
- [CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer
overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate
against the risk of remote code execution. The risk may be further
mitigated based on stack layout for any given platform/compiler.
Pre-announcements of CVE-2022-3602 described this issue as CRITICAL.
Further analysis based on some of the mitigating factors described above
have led this to be downgraded to HIGH. Users are still encouraged to
upgrade to a new version as soon as possible.
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

- [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.' character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

#### Alpha 3402.0.1
- OpenSSL
- [CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer
overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate
against the risk of remote code execution. The risk may be further
mitigated based on stack layout for any given platform/compiler.
Pre-announcements of CVE-2022-3602 described this issue as CRITICAL.
Further analysis based on some of the mitigating factors described above
have led this to be downgraded to HIGH. Users are still encouraged to
upgrade to a new version as soon as possible.
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

- [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786) Severity: High
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.' character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

---

### Communication

#### Go/No-Go message for Matrix/Slack

Go/No-Go Meeting for Stable 3227.2.4, Beta 3374.1.1, Alpha 3402.0.1
Pre-view images are available in https://bincache.flatcar-linux.net/images/amd64/$VERSION/
Tracking issue: https://github.com/flatcar/Flatcar/issues/XY
The Go/No-Go document is in our HackMD @flatcar namespace
Link: https://hackmd.io/LINKHERE?view

Please give your Go/No-Go vote with 💚 for Go, ❌ for No-Go, and ✋ for Wait.

Contributors & community feel free to put your suggestions, thoughts or comments on the document or here in the chat.

@MAINTAINER @MAINTAINER @MAINTAINER

#### Twitter

_The tweet (from [@flatcar](https://twitter.com/flatcar)) goes out after the changelog update has been published; it includes a link to the web changelog._

New Flatcar Alpha, Beta, Stable Security releases now available!
🔒 CVE fixes for the OpenSSL CVEs CVE-2022-3602, CVE-2022-3786
📜 Release notes at the usual spot: https://www.flatcar.org/releases/

#### Kubernetes Slack

_This goes in the #flatcar channel_

New Flatcar Alpha, Beta, Stable Security releases now available!
🔒 CVE fixes for the OpenSSL CVEs CVE-2022-3602, CVE-2022-3786
📜 Release notes at the usual spot: https://www.flatcar.org/releases/