vania-janet/multiturn-rag-retrieval-data huggingface dataset:
VRVDR-49155 7.2 N/A CVE-2018-5265: Devices allow remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta- cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters. 
 VRVDR-48691 7.5 DSA-4544-1 CVE-2019-16866: Debian DSA-4544-1: unbound - security update 
 VRVDR-48133 8.8 DSA-4512-1 CVE-2019-13164, CVE-2019-14378: Debian DSA- 4512-1: qemu – security update 
 VRVDR-48132 7.5 DSA-4511-1 CVE-2019-9511, CVE-2019-9513: Debian DSA-4511- 1: nghttp2 – security update 
 VRVDR-47885 8.1 DSA-4495-1 CVE-2018-20836, CVE-2019-1125, CVE-2019-1999, CVE-2019-10207, CVE-2019-10638, CVE-2019- 12817, CVE-2019-12984, CVE-2019-13233, CVE- 2019-13631, CVE-2019-13648, CVE-2019-14283, CVE-2019-14284: Debian DSA-4495-1: linux – security update 









 1908c 



 Issues Resolved 



Issues resolved for 1908c

 Issue Number Priority Summary 

 VRVDR-49060 Major RA VPN: no ESP traffic from Hub to Spoke 
 VRVDR-49035 Major RA VPN: "show vpn ipsec sa" inbound/outbound bytes stats are swapped 
 VRVDR-48949 Major Add output for determining punt-path programming state to tech- support 
 VRVDR-48893 Critical RA VPN: intermittent ICMP loss through HUB due to misprogrammed punt path
* UI
* CLI
* API







 Accessing secrets 

After you store secrets in your IBM Cloud® Secrets Manager service instance, you can retrieve their values programmatically by using the APIs.



 Before you begin 

Before you begin, be sure that you have the required level of access. To view a list of your available secrets, you need the [Reader service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam). To retrieve the value of a secret, you need the [SecretsReader service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).





 Retrieving a secret in the UI 

Most secret types in Secrets Manager can't be retrieved directly from the Secrets Manager service dashboard. This security mechanism is in place by default to help to prevent inadvertent exposure of your sensitive data. Secret types that you can access in the UI include: [TLS certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-access-secretsdownload-certificate-ui)

You can retrieve all secret types programmatically by using the CLI, API, or SDKs. To see the steps for accessing arbitrary, iam_credentials, kv, and username_password secrets, switch to the CLI or API instructions.



 Downloading certificates 

To download a certificate by using the Secrets Manager UI, complete the following steps.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, open the overflow menu for the certificate that you want to download.
4. Click Download. The certificate file is downloaded to your local system.
Secrets Manager sets a limit on the rate in which a client can send API requests to it. The limit is 20 calls per second for all API methods.

As you construct your [YAML document](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-kubernetes-secretstutorial-kubernetes-secrets-update-deployment), keep in mind that each key in the data section is polled periodically by using REST from the Secrets Manager instance. Be aware that:



1. By default, the polling interval is set to 1 hour. For best results with Secrets Manager, the polling interval must be greater than 1000 * number of Kubernetes secrets. You can set this value by using spec.refreshInterval in the External Secrets template.
2. If you set the YAML to fetch a Secrets Manager secret by name rather than ID (keyByName: true), each data entry generates two API calls rather than one. Be extra careful with the number of data entries in the YAML configuration file if you select this option. For more information, see the [External Secrets documentation](https://external-secrets.io/latest/).







 Next steps 

Great job! In this tutorial, you learned how to set up Secrets Manager to securely populate application secrets to your cluster. Check out more resources to help you get started with Secrets Manager.



* Review the [secret types in Secrets Manager](https://external-secrets.io/latest/provider/ibm-secrets-manager/) that are supported by External Secrets Operator.
* Learn more about the [Secrets Manager API](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2).
* [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-28196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196)
* [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361)
* [CVE-2020-29362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29362)
* [CVE-2020-29363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363)
* [CVE-2020-8231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231)
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* [CVE-2020-8286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286)
* As a secrets reader, you can browse a high-level view of secrets, and you can access the payload of a secret. A secrets reader can't create secrets or modify the value of an existing secret.







 How is Secrets Manager different from Key Protect? 

There are a few key differences between using Key Protect and Secrets Manager to store your sensitive data. Secrets Manager offers flexibility with the types of secrets that you can create and lease to applications and services on-demand. Whereas, Key Protect delivers on encryption keys that are rooted in FIPS 140-2 Level 3

hardware security modules (HSMs).

For more information, see [Managing secrets in IBM Cloud](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloud).





 How is Secrets Manager different from Vault? 

With Secrets Manager, you can centrally manage secrets for your services or apps in a dedicated, single tenant instance. To control who on your team has access to specific secrets, you can create secret groups that map to [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) access policies in your IBM Cloud account. And, you can use [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-at-events) to track how users and applications interact with your Secrets Manager instance.





 Are community plug-ins for Vault supported by Secrets Manager? 

Currently, Secrets Manager offers foundational capabilities that don't exist in upstream Vault but are required to support operations for Secrets Manager as a managed service. These capabilities include a set of secrets engines to support secrets of various types in Secrets Manager, and an IBM Cloud Auth method that handles authentication between Vault and your IBM Cloud account.

Secrets Manager will continue to align with upstream Vault capabilities and plug-ins as it extends its support for more secrets engines in coming quarters.
}' "https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}/versions/{version_id}/locks_bulk"

A successful response returns details about the new locks, along with other metadata.

{
"secret_id": "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_group_id": "d8371728-95c8-4c12-b2af-1af98adb9e41",
"versions": [
{
"version_id": "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias": "current",
"locks":
"lock-3",
"lock-4"
],
"payload_available": true
},
{
"version_id": "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias": "previous",
"locks":
"lock-1",
"lock-2"
],
"payload_available": true
}
]
}

For more information about the required and optional request parameters, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2lock-secret).









 Unlocking secrets 

A secret is considered unlocked and able to be modified or deleted only after all of its associated locks are removed. You can use the Secrets Manager UI or APIs to delete locks that are associated with a secret.



 Deleting locks in the UI 

You can delete a lock that is attached to an existing secret by using the Secrets Manager UI.



1. In the console, click the Menu icon !
* [CVE-2018-14466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14466)
* [CVE-2018-14880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14880)
* [CVE-2018-10105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10105)
* [CVE-2018-16229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16229)
* [CVE-2018-16230](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16230)
* [CVE-2018-10103](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10103)
* [CVE-2018-14461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14461)
* [CVE-2018-16300](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16300)
* [CVE-2018-16228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16228)
* [CVE-2018-14465](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14465)
* [CVE-2018-14879](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14879)
* [CVE-2018-14462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14462)
* [CVE-2018-14881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14881)
* [CVE-2018-14470](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14470)
* [CVE-2018-14469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14469)
* [CVE-2018-16227](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16227)
* [CVE-2018-16452](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16452)
* [CVE-2018-14466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14466)
* [CVE-2018-14880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14880)
* [CVE-2018-10105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10105)
* [CVE-2019-25013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25013)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-29562](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29562)
* [CVE-2020-6096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6096)
* [CVE-2021-27645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27645)
* [CVE-2021-3326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326)
* [CVE-2021-35942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942)
* [CVE-2021-3998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3998)
* [CVE-2021-3999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3999)
* [CVE-2022-23218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23218)
Both secrets and configmaps are key-value pairs. When mapped to environment variables, the NAME=VALUE relationships are set such that the name of the environment variable corresponds to the "key" of each entry in those maps, and the value of the environment variable is the "value" of that key.

Your job can use environment variables to fully reference a configmap (or secret) or reference individual keys in a configmap (or secret).

For more information, see [referencing secrets by using environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-ref) and [referencing configmaps by using environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmapconfigmap-ref).







 What if I want my job to run indefinitely? 

Typically, jobs are designed to run one time and exit with a maximum execution time.

However, suppose that you want to constantly poll a third-party data store. You can choose to create an application; however, the app port must remain open to handle HTTP requests. Instead, if you don't want to service HTTP requests, you can choose to create a job that runs without a maximum execution time and does not time out.

With Code Engine, you can choose the mode of your job. For jobs where a maximum execution time applies, use task mode for your jobs. Failed instances are restarted per the job retries limit. This mode is the default behavior for jobs.

If you want to create a job that can run indefinitely and does not time out, use daemon mode for your jobs. Failed instances are automatically restarted indefinitely.

With Code Engine, you pay for only the resources that you use. When your job runs in daemon mode, be aware that the job is always running until you delete the job.

For more information, see [Creating and running a job that runs indefinitely](https://cloud.ibm.com/docs/codeengine?topic=codeengine-job-daemon) commands.





 Considerations for job quotas
"secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"secret_version_alias" : "current",
"updated_at" : "2022-10-05T21:33:11Z"
} ],
"next" : {
"href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/locks?offset=150&limit=50"
},
"offset" : 100,
"total_count" : 1
}







 ibmcloud secrets-manager secret-locks-bulk-create 

Create a lock on the current version of a secret.

A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to your secret, or replaces a lock of the same name if it already exists. Additionally, you can use this operation to clear any matching locks on a secret by using one of the following optional lock modes:



* remove_previous: Removes any other locks with matching names if they are found in the previous version of the secret.\n
* remove_previous_and_delete: Carries out the same function as remove_previous, but also permanently deletes the data of the previous secret version if it doesn't have any locks.



ibmcloud secrets-manager secret-locks-bulk-create --id ID --locks LOCKS [--mode MODE]



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters.
* UI
* API
* Terraform







 Enabling event notifications for Secrets Manager 

As an administrator of IBM Cloud® Secrets Manager, you might want to send notifications of events in Secrets Manager to other users, or human destinations, by using email, SMS, or other supported delivery channels. Additionally, you might want to send these notifications of events to other applications to build logic by using event-driven programming using webhooks, for example. This is made possible by the integration between Secrets Manager and IBM Cloud® Event Notifications.

To send information to Event Notifications, you must connect your Secrets Manager service instance to Event Notifications. For more information about working with Event Notifications, see [Getting started with Event Notifications](https://cloud.ibm.com/docs/event-notifications).



 How events are collected and sent by Secrets Manager 

When an event of interest takes place in your Secrets Manager instance, Secrets Manager communicates with a connected Event Notifications instance to forward a notification to a [supported destination](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination).

Secrets Manager aggregates a list of your pending notifications by [event type](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notificationsevent-notifications-list), the type of secret, and expiry details if they apply. Every 1 - 2 minutes, the service checks for and dispatches any pending notifications to the connected Event Notifications service. For example, you might receive notifications that are similar to the following messages:



* You have 1 arbitrary secret that expires in 1 day.
* You have 5 public certificate secrets that expire in 10 days.
* You have 100 imported certificate secrets that expire in 30 days.



100 is the maximum number of secrets that you can be notified of in a single event notification.





 Events for Secrets Manager 

The following table lists the Secrets Manager actions that generate an event.

Depending on the type of secret that you're working with in the service, an event might not be generated by Secrets Manager.
"key1": "val1",
"key2": "val2"
},
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"version_custom_metadata": {
"custom_version_key": "custom_version_value"
}
}' 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets"

A successful response returns the ID value of the secret, along with other metadata. For more information about the required and optional request parameters, see [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret).





 Creating key-value secrets with Terraform 

You can create key-value secrets programmatically by using Terraform for Secrets Manager.

Follow Terraform best practices for protecting sensitive input variables such as secret credentials. For more information, see [Protect sensitive input variables](https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables).

The following example shows a configuration that you can use to create a key-value secret by setting sensitive values in a terraform.tfvars file.



1. Define an input variable for the key-value secret data in a variables.tf file.



variable "kv_secret_data" {
description = "KV secret data"
type = map(any)
sensitive = true
}



2. Assign a value to the kv_secret_data variable in a terraform.tfvars file.

By setting values with a .tfvars file, you can separate sensitive values from the rest of your variable values, and ensure that your users who work with your configuration know which values are sensitive. For security purposes, you must maintain and share the .tfvars file only with your users who have the appropriate access. You must also be careful not to store .tfvars files with sensitive values into version control such as Github, in clear text.
* [CVE-2019-3842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842)
* [CVE-2019-9169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169)
* [CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434)
* [CVE-2020-13543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13543)
* [CVE-2020-13584](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13584)
* [CVE-2020-13776](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776)
* [CVE-2020-15358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358)
* [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-28196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196)
* [CVE-2020-15358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358)
* [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-28196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196)
* [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361)
* [CVE-2020-29362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29362)
* [CVE-2020-29363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363)
* [CVE-2020-8231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231)
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* [CVE-2019-2708](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2708)
* [CVE-2019-3842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842)
* [CVE-2019-9169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169)
* [CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434)
* [CVE-2020-13543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13543)
* [CVE-2020-13584](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13584)
* [CVE-2020-13776](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776)
* [CVE-2020-15358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358)
* [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
Viewer As a viewer, you can view Secrets Manager service instances, but you can't modify them. 
 Operator As an operator, you can complete platform actions that are required to configure and operate Secrets Manager service instances, such as the ability to view a Secrets Manager dashboard. 
 Editor As an editor, you can create, modify, and delete Secrets Manager service instances, but you can't assign access policies to other users. 
 Administrator As an administrator, you can complete all platform actions for Secrets Manager, including the ability to assign access policies to other users. 







 Assigning access to Secrets Manager 

You can use the IBM Cloud console, CLI, or APIs to assign different levels of access to Secrets Manager resources in your account. You can assign access at the instance level, or you can narrow access to a secret group that contains one or more secrets. For more information, see [Assigning access to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-assign-access).

To learn about using the IBM Cloud CLI to assign access, check out the [IBM Cloud CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam). When you create an access policy for Secrets Manager by using the IBM Cloud CLI or APIs, use secrets-manager for the service name in the CLI command or API call.
* [CVE-2023-27488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27488)
* [CVE-2023-27491](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27491)
* [CVE-2023-27492](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27492)
* [CVE-2023-27493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27493)
* [CVE-2023-27496](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27496)
* [CVE-2023-27533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27533)
* [CVE-2023-27534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27534)
* [CVE-2023-27535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27535)
* [CVE-2023-27536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27536)
* [CVE-2023-27538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27538)