vania-janet/multiturn-rag-retrieval-data huggingface dataset:
22826](https://nvd.nist.gov/vuln/detail/CVE-2022-22826)[CVE-2022-22827](https://nvd.nist.gov/vuln/detail/CVE-2022-22827), [CVE-2022-23852](https://nvd.nist.gov/vuln/detail/CVE-2022-23852), [CVE-2022-25235](https://nvd.nist.gov/vuln/detail/CVE-2022-25235), [CVE-2022-25236](https://nvd.nist.gov/vuln/detail/CVE-2022-25236), [CVE-2022-25315](https://nvd.nist.gov/vuln/detail/CVE-2022-25315), [CVE-2021-4028](https://nvd.nist.gov/vuln/detail/CVE-2021-4028), [CVE-2021-4083](https://nvd.nist.gov/vuln/detail/CVE-2021-4083)[CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778). 







 Change log for master fix pack 4.8.35_1552_openshift, released 6 April 2022 



Changes since version 4.8.31_1546_openshift

 Component Previous Current Description 

 Cluster health image v1.3.3 v1.3.5 Update golang dependencies.
RHEL 7 Packages 3.10.0-1160.15.2.el7 3.10.0-1160.21.1.el7 Updated worker node images with kernel and package updates for [CVE-2019-19532](https://nvd.nist.gov/vuln/detail/CVE-2019-19532), [CVE-2020-0427](https://nvd.nist.gov/vuln/detail/CVE-2020-0427), [CVE-2020-7053](https://nvd.nist.gov/vuln/detail/CVE-2020-7053), [CVE-2020-14351](https://nvd.nist.gov/vuln/detail/CVE-2020-14351), [CVE-2020-25211](https://nvd.nist.gov/vuln/detail/CVE-2020-25211), [CVE-2020-25645](https://nvd.nist.gov/vuln/detail/CVE-2020-25645), [CVE-2020-25656](https://nvd.nist.gov/vuln/detail/CVE-2020-25656), [CVE-2020-25705](https://nvd.nist.gov/vuln/detail/CVE-2020-25705), [CVE-2020-28374](https://nvd.nist.gov/vuln/detail/CVE-2020-28374), [CVE-2020-29661](https://nvd.nist.gov/vuln/detail/CVE-2020-29661), and [CVE-2021-20265](https://nvd.nist.gov/vuln/detail/CVE-2021-20265). 







 Change log for worker node fix pack 4.6.20_1534_openshift, released 12 March 2021 

The following table shows the changes that are in the worker node fix pack 4.6.20_1534_openshift.
HAProxy 468c09 04f862 [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271). 
 containerd v1.6.4 v1.6.6 See the [change log](https://github.com/containerd/containerd/releases/tag/v1.6.6), the [security bulletin](https://www.ibm.com/support/pages/node/6597989) for [CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030), and the [security bulletin](https://www.ibm.com/support/pages/node/6598049) for [CVE-2022-29162](https://nvd.nist.gov/vuln/detail/CVE-2022-29162). 
 Kubernetes 1.23.7 1.23.8 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.8). 







 Change log for worker node fix pack 1.23.7_1532, released 7 June 2022 

The following table shows the changes that are in the worker node fix pack 1.23.7_1532. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.6_1530

 Component Previous Current Description
etcd v3.3.25 v3.3.26 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.26). 
 IBM Cloud File Storage for Classic plug-in and monitor 400 401 Updated universal base image (UBI) to the latest 8.4-210 version to resolve CVEs. 
 Key Management Service provider v1.0.17 v1.0.18 Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs: [CVE-2021-36222](https://nvd.nist.gov/vuln/detail/CVE-2021-36222), [CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750), [CVE-2021-22922](https://nvd.nist.gov/vuln/detail/CVE-2021-22922), [CVE-2021-22923](https://nvd.nist.gov/vuln/detail/CVE-2021-22923), and [CVE-2021-22924](https://nvd.nist.gov/vuln/detail/CVE-2021-22924). 
 Red Hat OpenShift Container Platform 3.11.521 3.11.524 See the [Red Hat OpenShift Container Platform release notes.](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-524) 







 Change log for worker node fix pack 3.11.524_1609_openshift, released 25 October 2021 

The following table shows the changes that are in the worker node fix pack patch update 3.11.524_1609_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.524_1606_openshift

 Component Previous Current Description
Ubuntu 20.04 packages N/A N/A Worker node package updates for [CVE-2023-22490](https://nvd.nist.gov/vuln/detail/CVE-2023-22490), [CVE-2023-23946](https://nvd.nist.gov/vuln/detail/CVE-2023-23946), [CVE-2023-25725](https://nvd.nist.gov/vuln/detail/CVE-2023-25725). 
 Kubernetes N/A N/A N/A 
 HAProxy d38f89 af5031 [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897), [CVE-2022-4415](https://nvd.nist.gov/vuln/detail/CVE-2022-4415), [CVE-2020-10735](https://nvd.nist.gov/vuln/detail/CVE-2020-10735), [CVE-2021-28861](https://nvd.nist.gov/vuln/detail/CVE-2021-28861), [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061). 
 Default Worker Pool Ubuntu 18 Ubuntu 20 For IBM Cloud Kubernetes Service, default worker-pool is created with Ubuntu 20 Operating system 







 Change log for worker node fix pack 1.24.10_1553, released 13 February 2023 

The following table shows the changes that are in the worker node fix pack 1.24.10_1553. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.24.10_1552

 Component Previous Current Description
Ubuntu 18.04 packages 4.15.0-147 4.15.0-151 Updated worker node images & Kernel with package updates: [CVE-2020-13529](https://nvd.nist.gov/vuln/detail/CVE-2020-13529), [CVE-2021-22898](https://nvd.nist.gov/vuln/detail/CVE-2021-22898), [CVE-2021-22924](https://nvd.nist.gov/vuln/detail/CVE-2021-22924)[CVE-2021-22925](https://nvd.nist.gov/vuln/detail/CVE-2021-22925), [CVE-2021-33200](https://nvd.nist.gov/vuln/detail/CVE-2021-33200), [CVE-2021-33909](https://nvd.nist.gov/vuln/detail/CVE-2021-33909), and [CVE-2021-33910](https://nvd.nist.gov/vuln/detail/CVE-2021-33910). 
 HA proxy aae810 68e6b3 Updated image with fixes for [CVE-2021-33910](https://nvd.nist.gov/vuln/detail/CVE-2021-33910). 
 Registry endpoints Added zonal public registry endpoints for clusters with both private and public service endpoints enabled. 
 Read only disk self healing For VPC Gen2 workers. Added automation to recover from disks going read only. 







 Change log for master fix pack 1.18.20_1559, released 27 July 2021 

The following table shows the changes that are in the master fix pack patch update 1.18.20_1559. Master patch updates are applied automatically.



Changes since version 1.18.20_1556

 Component Previous Current Description 

 Cluster health image v1.1.23 v1.1.24 Updated universal base image (UBI) to the latest version to resolve CVEs.
: The SDK for Node.js buildpack v4.5 is based on community buildpack v1.7.36, introduces v14 runtimes, and includes the following Node.js runtimes: v10.22.1, v10.23.0, v12.19.0, v12.19.1, v14.15.0, v14.15.1. The default runtime is the latest v10.x (currently 10.23.0). This buildpack is based on the community node.js buildpack [v1.7.36](https://github.com/cloudfoundry/nodejs-buildpack/releases/tag/v1.7.36).

This release also includes CVE-2020-8201, CVE-2020-8251, CVE-2020-8252, CVE-2020-8277:



* [September 2020 Security Releases](https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/)
* [November 2020 Security Releases](https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/)







 16 November 2020 

Updated Liberty buildpack v3.51-20201113-1351
: The default Liberty runtime GA version is the 20.0.0.12 release.



* The alternate Liberty runtime GA version is changed to the 20.0.0.12 release.
* The AdoptOpenJDK OpenJ9 alternate JRE was updated to version 11.0.9_11_openj9-0.23.0.
* The alternate Liberty runtime version 20.0.0.12 includes a fix for the [CVE-2020-10693 security vulnerability](https://www.ibm.com/support/pages/node/6348216).
* The IBM JRE Version (8 SR 6 FP16) remains unchanged







 22 October 2020 

Updated Liberty buildpack v3.50-20201019-1521
-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061), [CVE-2022-47929](https://nvd.nist.gov/vuln/detail/CVE-2022-47929), [CVE-2023-0394](https://nvd.nist.gov/vuln/detail/CVE-2023-0394), [CVE-2023-0461](https://nvd.nist.gov/vuln/detail/CVE-2023-0461), [CVE-2023-0778](https://nvd.nist.gov/vuln/detail/CVE-2023-0778), [CVE-2023-1195](https://nvd.nist.gov/vuln/detail/CVE-2023-1195), [CVE-2023-1582](https://nvd.nist.gov/vuln/detail/CVE-2023-1582), [CVE-2023-23454](https://nvd.nist.gov/vuln/detail/CVE-2023-23454), [CVE-2023-27535](https://nvd.nist.gov/vuln/detail/CVE-2023-27535). 
 Haproxy N/A N/A N/A 







 Change log for worker node fix pack 4.10.59_1566_openshift, released 10 May 2023 

The following table shows the changes that are in the worker node fix pack 4.10.59_1566_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.10.57_1565_openshift

 Component Previous Current Description 

 RHEL 8 Packages N/A N/A N/A 
 Red Hat OpenShift on IBM Cloud.
Haproxy 468c09 04f862 [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271). 
 containerd v1.5.11 v1.5.13 See the [change log](https://github.com/containerd/containerd/releases/tag/v1.5.13), the [security bulletin](https://www.ibm.com/support/pages/node/6597989) for [CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030), and the [security bulletin](https://www.ibm.com/support/pages/node/6598049) for [CVE-2022-29162](https://nvd.nist.gov/vuln/detail/CVE-2022-29162). 
 Kubernetes 1.21.13 1.21.14 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.21.14). 







 Change log for worker node fix pack 1.21.13_1562, released 7 June 2022 

The following table shows the changes that are in the worker node fix pack 1.21.13_1562. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.21.12_1560

 Component Previous Current Description
For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs). 
 Wrapped data encryption key For an encrypted image, specify the ciphertext that is associated with the wrapped data encryption key (WDEK). The WDEK is produced by wrapping the passphrase that you used to encrypt your image with your customer root key. For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs). 
 Manage image lifecycle (optional) Select to schedule status changes for the image. You can schedule a single status change or schedule the complete lifecycle of the image. The image statuses are:<br><br><br><br> * available: The image can be used to create an instance.<br> * deprecated: The image is still available to use to provision an instance. Using the deprecated status can discourage use of the image before the status changes to obsolete.<br> * obsolete: The image is not available to use to provision an instance.<br> * Schedule complete lifecycle: You can schedule both the deprecated and obsolete status changes at the same time.<br><br><br><br>You can move back and forth between the three statuses. Only the statuses you can change to are displayed. You can schedule status changes by using calendar date and time or number of days. The obsolescence date must always be after the deprecation date. 







 Importing a custom image by using the CLI 

Make sure that your compatible custom image is available in IBM Cloud Object Storage.
Creating an encrypted custom image 

When you have a qcow2 custom image that meets the requirements for IBM Cloud® Virtual Private Cloud infrastructure, you can encrypt it. The following procedure describes how to encrypt your custom image with LUKS encryption by using QEMU and your own unique passphrase. After you encrypt the image, you wrap the passphrase with your customer root key (CRK). The wrapped (or encrypted) data encryption key is stored with your image metadata when you import it to IBM Cloud VPC.

A quick way to create an encrypted custom image is by using image from volume. You can use this feature to create a custom image from the boot volume of an instance and specify customer-managed encryption. For more information, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).

You can't use an encrypted custom image in a private catalog or on a bare metal server.



 How encrypted custom images work 

After you encrypt a custom image with your own passphrase, you upload it to IBM Cloud Object Storage. Before you import the encrypted image to IBM Cloud VPC, you need to set up a key management service (KMS) and create a customer root key (CRK). Then, use your CRK to protect the passphrase that you use to encrypt your image. By wrapping your secret passphrase with your CRK, you create what the KMS refers to as a wrapped data encryption key (WDEK). Wrapping your passphrase data encrypts it and secures it so that you never need to share your passphrase in plain text.

When you import the image, you must specify the cloud resource name (CRN) for your customer root key (CRK) that is stored in your KMS. You must also specify the ciphertext for your wrapped data encryption key (WDEK). The passphrase is stored encrypted in the WDEK always.
Any secondary volumes that you create and attach from the encrypted custom image use a different passphrase than the base custom image. Optionally, you can provide a different root key for secondary volumes that are created during instance provisioning.

For more information about creating custom images, see [Creating an encrypted custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-image). Also, see information for creating a [Linux custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-linux-custom-image) and [Windows custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-windows-custom-image).



 Flow diagram for specifying customer-managed encryption for custom images 

Figure 3 shows the procedure for encrypting custom images with your own encryption keys.

Zoom

![Figure shows the procedure for creating encrypted custom images.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpc-flowchart-encrypted-images-color.svg)

Figure 3. Creating custom images with customer-managed encryption.









 Next Steps 



* [Review the checklist](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningplanning-for-data-encryption) for planning data encryption and complete the [prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningbyok-encryption-prereqs).
* [Create virtual server instances with customer-managed encryption volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok).
* You can't create an image from an encrypted boot volume (image from a volume) that is not 100 GB. The operation is blocked.
* For custom images with Red Hat Enterprise Linux® or Windows® operating systems, you must select the appropriate version of the operating system. Depending on how you configured the image, select either bring your own license byol, or if you plan to license the OS through IBM Cloud, select the version without byol appended.



For more information about custom images, see [Getting started with custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images).





 Importing a custom image by using the UI 

When you have an image available in IBM Cloud Object Storage, you can import it to IBM Cloud VPC infrastructure by using the IBM Cloud console.



1. Make sure that your compatible custom image is available in IBM Cloud Object Storage. To upload an image to IBM Cloud Object Storage, on the Objects page of your bucket, click Upload. You can use the Aspera high-speed transfer plug-in to upload images larger than 200 MB. For more information, see [Creating a Linux custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-linux-custom-image), [Creating a Windows custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-windows-custom-image), [Bring your own license](https://cloud.ibm.com/docs/vpc?topic=vpc-byol-vpc-about) and [Uploading data](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-upload) to IBM Cloud Object Storage.
2. In [IBM Cloud console](https://cloud.ibm.com/login), go to Menu icon !
For more information, see [Custom images in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uicustom-image-cloud-private-catalog) and the tutorial [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial). Custom images can't be deleted if they are managed from a catalog and can be managed from only one catalog product offering version at a time. Deleting the catalog does not free its managed resources for a 7-day reclamation period. For more information, see [Deleting a custom image in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uideleting-private-catalog-custom-image-vpc) and [Using resource reclamations](https://cloud.ibm.com/docs/account?topic=account-resource-reclamation). If you plan to share images with other accounts, users in those accounts must be aware of considerations that are related to cross-account references to those images. For more information, see [Using cross-account image references in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uiprivate-catalog-image-reference-vpc-ui). Custom images can also be published to the IBM Cloud catalog and to other (nonenterprise) accounts. This process requires onboarding to the [IBM Cloud Partner Center](https://cloud.ibm.com/partner-center/sell).

Deprecated VPN for VPC ciphers
: The following VPN for VPC IKE and IPsec ciphers are now deprecated:



* Authentication algorithms md5 and sha1
* Encryption algorithm triple_des
* Diffie–Hellman groups 2 and 5



You have until 13 December 2022 to upgrade to more secure ciphers.
You can create a QCOW2 custom image that meets the requirements for IBM Cloud VPC infrastructure and [encrypt it](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagemanually-encrypt-image) by using your own LUKS passphrase and root key. After you encrypt the custom image with your own passphrase, you upload it to IBM Cloud Object Storage.

To import an encrypted custom image to IBM Cloud VPC, begin by setting up a key management service (KMS) instance, either Key Protect or Hyper Protect Crypto Services. In the KMS instance, you create a root key for wrapping (encrypting) the passphrase. Wrapping the passphrase produces a wrapped DEK (WDEK). The WDEK protects the passphrase at import time, keeping your data secure. (The passphrase is stored encrypted in the image service and unwrapped only when a virtual server that uses the encrypted image is started.)

With the required IAM authorizations in place, you can import the encrypted image from IBM Cloud Object Storage. You import the image to the VPC and specify the cloud resource name (CRN) for your root key that is stored in the KMS. You also specify the ciphertext for your WDEK, which is the passphrase that you use to encrypt your image, wrapped by the root key.

When you import with the API or UI, you supply a single QCOW2 boot image file that can be 10 GB to 250 GB. This file is private to the account to which it is imported. The region where you import the encrypted image is the region where you create virtual server instances from that image. The encrypted image displays with other custom images that you have permission to use. In the UI, a lock icon next to the name indicates that it's an encrypted custom image.
* Must be an x86 image
* Can't be encrypted
* Can't be used with a bare metal profile
* Can exist in only one version of one catalog product offering in one private catalog at a time
* Must be in available status







 Using cross-account image references in a private catalog in the UI 

Instances you provision belong to your account. Images shared to your account through a private catalog might belong to other accounts. When you provision an instance from an image that belongs to another account or from an instance template that specifies such an image, the image still belongs to the other account even though the instance belongs to your account. A reference to such an image might exist in details of the instance and related resources. For example, details about its boot volume and any snapshot that was created from that boot volume might reference that image. Regardless of your authorizations, you can't access the referenced image by its ID or CRN and attempts fail as if the image does not exist.

Additionally, it is possible that the referenced image might have the same name as a custom image in your account. But these image names are for two different images in two different accounts. The ID and CRN each uniquely identifies an image across IBM Cloud®. To avoid possible retrieval or use of the wrong image, when you cut-and-paste an image’s identity outside of the UI, use its ID or CRN, rather than its name.





 Using cross-account image references in a private catalog in the CLI 

Instances you provision belong to your account. Images shared to your account through a private catalog might belong to other accounts. When you provision an instance from an image that belongs to another account or from an instance template that specifies such an image, the image still belongs to the other account even though the instance belongs to your account. A reference to such an image might exist in details of the instance and related resources. For example, details about its boot volume and any snapshot that was created from that boot volume might reference that image. Regardless of your authorizations, you can't access this type of custom image by its ID and attempts fail as if the image does not exist.

Image references are used in a few different places in the CLI.