vania-janet/multiturn-rag-retrieval-data huggingface dataset:
<br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC Open following ports by default: 53 (DNS service). <br>All ports to PowerVS workspace are open. <br>All ports to other VPCs are open. More ports might be opened in preset or added manually after deployment 
 <br><br> * Enable floating IP on bastion host to execute deployment<br><br><br> Floating IPs on bastion host in management VPC Use floating IP on bastion host from IBM Schematics to complete deployment 
 <br><br> * Preload VPN configuration to simplify VPN setup<br><br><br> VPNs VPN configuration is the responsibility of the customer 







 Key and password management architecture decisions 



Table 5. Key and passwords management architecture decisions

 Requirement Component Choice Alternative choice 

 <br><br> * Use public/private SSH key to access virtual server instances by using SSH<br> * Use SSH proxy to log in to all virtual server instances by using the bastion host<br> * Do not store private ssh key on any virtual instances, also not on the bastion host<br> * Do not allow any other SSH login methods except the one with specified private/public SSH key pair<br><br><br> Public SSH key - provided by customer. Private SSH key - provided by customer. Ask customer to specify the keys. Accept the input as secure parameter or as reference to the key stored in IBM Cloud Secure Storage Manager. Do not print SSH keys in any log files. Do not persist private SSH key. 









 Compliance 

This reference architecture is certified for SAP deployments.





 Next steps 

Install the SAP on Power deployable architecture on this infrastructure.
VRVDR-49439 Major Path Monitor does not handle fractional ping loss correctly 
 VRVDR-48944 Critical SIAD dataplane crash when removing tunnels interface config 
 VRVDR-47869 Minor L2TP/IPsec with x.509 authentication fails due to incorrect path to certificates 
 VRVDR-46719 Critical Poor TCP performance in iperf over IPSEC VTI (expect 600Mbps but measuring 2Mbps) 
 VRVDR-45071 Critical vyatta-security-vpn: vpn-config.pl: l2tp remote-access dhcp-interface "lo.tag;/tmp/bad.sh;echo " / code injection 
 VRVDR-45069 Critical] vyatta-security-vpn: set security vpn rsa-keys local-key file "/tmp/bad.sh;/tmp/bad.sh" / code injection 
 VRVDR-45068 Critical vyatta-security-vpn: s2s tunnel protocol syntax script / code injection 
 VRVDR-45067 Critical vyatta-security-vpn: set security vpn ipsec site-to-site peer $CODE / code injection 
 VRVDR-45066 Critical vyatta-security-vpn: check_file_in_config passed unsanitized user input / code injection 
 VRVDR-45065 Critical vyatta-security-vpn-secrets: code injection 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908e

 Issue Number CVSS score Advisory Summary 

 VRVDR-49834 7.8 DSA-4614-1 CVE-2019-18634: Debian DSA-4614-1 : sudo - security update 
 VRVDR-49832 9.8 DSA-4616-1 CVE-2019-15890, CVE-2020-7039, CVE-2020-1711: Debian DSA-4616-1: qemu – security update
VRVDR-56903 9.1 DSA-5056-1 CVE-2021-45079: Debian DSA-5056-1: strongswan security update 
 VRVDR-56843 7.1 DSA-5043-1 CVE-2021-43818: Debian DSA-5043-1 : lxml -security update 
 VRVDR-56831 5.9 DSA-5040-1 CVE-2022-22707: Debian DSA-5040-1 : lighttpd -security update 
 VRVDR-56706 7.5 DSA-5019-1 CVE-2021-22207, CVE-2021-22222, CVE-2021-22235, CVE-2021-39920, CVE-2021-39921, CVE-2021-39922, CVE-2021-39923, CVE-2021-39924, CVE-2021-39925, CVE-2021-39926, CVE-2021-39928, CVE-2021-39929: Debian DSA-5019-1: wireshark –security update 
 VRVDR-56656 9.8 DSA-5016-1 CVE-2021-43527: Debian DSA-5016-1 : nss-security update 
 VRVDR-56624 5.5 DSA-5014-1 CVE-2020-21913: Debian DSA-5014-1 : icu -security update 









 2012g 



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 2012g

 Issue Number CVSS score Advisory Summary 

 VRVDR-56909 7.8 N/A CVE-2021-4034: policykit-1 security update 









 1912u 



 Issues Resolved 



Issues resolved for 1912u

 Issue Number Priority Summary 

 VRVDR-56932 Critical L2TPtunnels fail to establish after the upgrade from 1801zb to 1912r 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912u

 Issue Number CVSS score Advisory Summary
VRVDR-45649 Major Route Leaking into VRF not working as expected - pings not resolving 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908f

 Issue Number CVSS score Advisory Summary 

 VRVDR-50166 9.8 DSA-4633-1 CVE-2019-5436, CVE-2019-5481, CVE-2019-5482: Debian DSA-4633-1 : curl - security update 
 VRVDR-50161 9.8 DSA-4632-1 CVE-2020-8597: Debian DSA-4632-1 : ppp - security update 









 1908e 



 Issues Resolved 



Issues resolved for 1908e

 Issue Number Priority Summary 

 VRVDR-49924 Blocker Commit failed in IPsec site-to-site configuration 
 VRVDR-49822 Critical Only shows peering with 16 nodes in "show ptp clock 0" 
 VRVDR-49684 Blocker DHCP services within VRF failed to start after enabling secure boot 
 VRVDR-49633 Critical tcp_auth_collapse NULL pointer dereference causes kernel panic during SYN flood 
 VRVDR-49631 Blocker PTP error message found on UFI06 
 VRVDR-49584 Minor GRE over IPsec in transport mode (IKEv1) - responder intermittently replies "no acceptable traffic selectors found" 
 VRVDR-49568 Critical Flexware XS and S: kernel panics on start after update to 4.19.93 
 VRVDR-49459 Major Ping monitor may send more packets than specified in "packets" 
 VRVDR-49439 Major Path Monitor does not handle fractional ping loss correctly 
 VRVDR-48944 Critical SIAD dataplane crash when removing tunnels interface config 
 VRVDR-47869 Minor L2TP/IPsec with x.509 authentication fails due to incorrect path to certificates 
 VRVDR-46719 Critical Poor TCP performance in iperf over IPSEC VTI (expect 600Mbps but measuring 2Mbps)
: Resolves the following CVEs



* [CVE-2020-15104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15104)
* [CVE-2017-12133](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12133)
* [CVE-2017-18269](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18269)
* [CVE-2018-11236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11236)
* [CVE-2018-11237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11237)
* [CVE-2018-19591](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19591)
* [CVE-2018-6485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6485)
* [CVE-2019-19126](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126)
* [CVE-2019-9169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169)
* [CVE-2020-10029](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10029)
: Resolves the following CVEs



* [CVE-2020-27350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27350)
* [CVE-2020-8231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231)
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* [CVE-2020-8286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286)
* [CVE-2021-23239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23239)
* [CVE-2021-3156](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156)
* [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361)
* [CVE-2020-29362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29362)
* [CVE-2020-29363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363)
Issue Number Priority Summary 

 VRVDR-50467 Critical Marvell : Sometimes after dataplane crash front panel ports do not come up 
 VRVDR-50387 Major qemu-wrap.py script confusing libvirt/virsh 
 VRVDR-50376 Major Increase max number of clients of dp_events 
 VRVDR-50293 Critical Forwarded cross VRF traffic blackholed when SNAT is applied 
 VRVDR-50191 Critical Packet capture leaking mbufs under heavy load 
 VRVDR-49991 Blocker Enable hardware platform reboot on NMI panic 
 VRVDR-49951 Major SNMP errors during PTP configuration 
 VRVDR-49750 Critical TACACS+ authz sent for user * on Bash path completion 
 VRVDR-49739 Major SFlow not sending packets out 
 VRVDR-49797 Major vyatta-openvpn: code injection due to scripts in tmplscripts 
 VRVDR-49683 Critical 1908d performance issue with QoS seeing significant reduction in performance 
 VRVDR-49472 Major ENTITY-SENSOR-MIB: Incorrect OID values 
 VRVDR-49470 Critical ENTITY-MIB: Missing entPhysicalDescr OID 
 VRVDR-49316 Blocker SNMP entity subagent failed to handle month 12 
 VRVDR-48861 Critical Vyatta VNF creating extra RX queues 
 VRVDR-47761 Minor Spurious log: LLADDR: NEWNEIGH without link layer address? 
 VRVDR-45649 Major Route Leaking into VRF not working as expected - pings not resolving 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908f

 Issue Number CVSS score Advisory Summary 

 VRVDR-50166 9.8 DSA-4633-1 CVE-2019-5436, CVE-2019-5481, CVE-2019-5482: Debian DSA-4633-1 : curl - security update
VRVDR-53231 N/A DLA-2382-1 CVE-2020-8231: Debian DLA-2382-1 : curl security update 
 VRVDR-53230 3.7 DLA-2378-1 CVE-2020-1968: Debian DLA-2378-1 : openssl1.0 security update 
 VRVDR-52817 6.4 N/A CVE-2020-15705: GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed 
 VRVDR-52457 7.8 DLA-2301-1 CVE-2020-12762: Debian DLA-2301-1 : json-c security update 
 VRVDR-52456 6.7 DLA-2290-1 CVE-2019-5188: Debian DLA-2290-1 : e2fsprogs security update 
 VRVDR-52454 N/A DLA-2295-1 CVE-2020-8177: Debian DLA-2295-1 : curl security update 
 VRVDR-52357 5.6 DSA-4733-1 CVE-2020-8608: Debian DSA-4733-1: qemu security update 
 VRVDR-52273 6.7 DSA-4728-1 CVE-2020-10756, CVE-2020-13361, CVE-2020-13362, CVE-2020-13754, CVE-2020-13659: Debian DSA 4728-1: qemu security update
Security vulnerabilities resolved for 1801y

 Issue Number CVSS score Advisory Summary 

 VRVDR-46139 7.0 DSA-4428-1 CVE-2019-3842: Debian DSA-4428-1 : systemd - security update 
 VRVDR-46087 N/A DSA-4425-1 CVE-2019-5953: Debian DSA-4425-1 : wget - security update 
 VRVDR-45897 7.5 DSA-4416-1 CVE-2019-5716, CVE-2019-5717, CVE-2019-5718, CVE-2019-5719, CVE-2019-9208, CVE-2019-9209, CVE-2019-9214: Debian DSA-4416-1 : wireshark - security update 
 VRVDR-45553 5.9 DSA-4400-1 CVE-2019-1559: Debian DSA-4400-1 : openssl1.0 - security update 
 VRVDR-45549 6.5 DSA-4397-1 CVE-2019-3824: Debian DSA-4397-1 : ldb - security update 
 VRVDR-45347 6.8 DSA-4387-1 CVE-2018-20685, CVE-2019-6109, CVE-2019-6111: Debian DSA-4387-1 : openssh - security update 



The following commands have been deprecated from this patch and are no longer available: * policy route pbr <name> rule <rule-number> application name <name> * policy route pbr <name> rule <rule-number> application type <type> * policy qos name <policy-name> shaper class <class-id> match <match-name> application name <name> * policy qos name <policy-name> shaper class <class-id> match <match-name> application type <type> * security application firewall name <name> rule <rule-number> name <app-name>

Running any of the above commands will result with the error message “This feature is disabled.”







 1801w 



 Issues Resolved
VRVDR-57307 Critical Attempting NAT on an ICMP other than echo request/reply causes dataplane crash 
 VRVDR-56672 Critical NAT SIP ALG misinterprets SDP part of packet payload header causing dataplane crash 
 VRVDR-56576 Critical Dataplane crash while capturing traffic 
 VRVDR-56560 Minor GNSS: use UBX-NAV-SAT to get visible satellites 
 VRVDR-56533 Major VRRPv3 sync group o/p shows incorrect state 
 VRVDR-56119 Critical PTP: Intermittently "show gnss" does not return 
 VRVDR-47554 Major Validate GREtunnel transport local-ip 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 2012h

 Issue Number CVSS score Advisory Summary 

 VRVDR-57353 7.5 DLA-2935-1 CVE-2018-25032: Debian DSA-5111-1 : zlib -security update 
 VRVDR-57317 7.1 DSA-5108-1 CVE-2022-0561, CVE-2022-0562, CVE-2022-0865, CVE-2022-0891, CVE-2022-0907, CVE-2022-0908, CVE-2022-0909, CVE-2022-0924, CVE-2022-22844: Debian DSA-5108-1 : tiff -security update 
 VRVDR-57273 7.5 DSA-5105-1 CVE-2021-25220, CVE-2022-0396: Debian DSA-5105-1 : bind9 -security update 
 VRVDR-57243 7.5 DSA-5103-1 CVE-2021-4160, CVE-2022-0778: Debian DSA-5103-1: openssl security update 
 VRVDR-57102 8.8 DSA-5087-1 CVE-2022-24407: Debian DSA-5087-1 :cyrus-sasl2 -security update
VRVDR-50256 Blocker Login fails with recent master images - Error in service module 
 VRVDR-50075 Major Sandbox cleanup fails for deleted TACACS+ user with open sessions 
 VRVDR-49985 Major L3ACL: CLI command and validation for IPv6 ACL rules with fragment option 
 VRVDR-49959 Major Change the yang accepted on SIAD to refuse ACLs specifying 'protocol final' 
 VRVDR-49808 Critical TACACS+ logins of users with "exotic" usernames fail when user isolation is enabled 
 VRVDR-49502 Major Login fails for isolated users whose name contains an underscore 
 VRVDR-49491 Critical User Isolation shared-storage not accessible in Master image after upgrade 
 VRVDR-49442 Major SNMP related syslog messages at wrong log level 
 VRVDR-49231 Critical PPPoE Client - Not re-establishing dropped connection automatically 
 VRVDR-48438 Major LACP causing interface to remain down 
 VRVDR-47530 Critical OSPF scaling: regression script fails bringing up many OSPF neighbors 
 VRVDR-45369 Major show interface dataplane X physical incorrectly reports speed when down 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912e

 Issue Number CVSS score Advisory Summary 

 VRVDR-51526 7.8 DSA-4699-1 CVE-2019-19462, CVE-2019-3016, CVE-2020-0543, CVE-2020-10711, CVE-2020-10732, CVE-2020-10751, CVE-2020-10757, CVE-2020-12114, CVE-2020-12464, CVE-2020-12768, CVE-2020-12770, CVE-2020-13143: Debian DSA-4699-1 : linux - security update
VRVDR-57814 Major Crash of IKE control-plane during shutdown or VRRP backuptransition 
 VRVDR-57797 Major IPsec: Crypto device limit causing tunnel setup failure 
 VRVDR-57778 Major Vyatta configuration lost after reboot with ' vrrp vrrp-group hellosource-address <x.x.x.x>' command 
 VRVDR-57760 Minor SYN-SENT no longer displayed in journal/logs up on upgrade from 1801zf to 1912q 
 VRVDR-57467 Critical Banner with newline prevents loading configuration after upgrade from 1903j to 1908n 
 VRVDR-57146 Critical QinQ: The config prompt does not return after deleting the vif from the dataplane interface. Hence QinQ scripts are failing 
 VRVDR-56916 Critical Installer errors and fails to install image on upgrade of Flexware box from 1903 
 VRVDR-56702 Critical add system image for Kington fails when base image is 1912p, works fine from 1903m base 
 VRVDR-56336 Blocker Power-cycling or reboot hardware intermittently results in disk boot corruption so that SIAD is a grub prompt unable to boot 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 2012k

 Issue Number CVSS score Advisory Summary 

 VRVDR-58044 9.1 DSA-5147-1 CVE-2022-1664: Debian DSA-5147-1 : dpkg - security update 
 VRVDR-58014 6.5 DSA-5142-1 CVE-2022-29824: Debian DSA-5142-1 : libxml2 - security update 
 VRVDR-57991 9.8 DSA-5140-1 CVE-2022-29155: Debian DSA-5140-1 : openldap - security update 
 VRVDR-57926 9.8 DSA-5139-1 CVE-2022-1292: Debian DSA-5139-1 : openssl - security update
VRVDR-55160 Blocker dataplane: srvAdaptiveFrequencyReferenceTracker.c:91: getStraightenedLocalTimestampsAdaptiveFrequency: Assertion '((direction == E_srvUpLinkDirection) (direction == E_srvDownLinkDirection))' failed 
 VRVDR-54128 Critical PDV syslogs are observed in huge number 
 VRVDR-53790 Critical Crash in mngPtpSessionStop 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912p

 Issue Number CVSS score Advisory Summary 

 VRVDR-55602 8.8 DSL-2699-1 CVE-2020-5208: Debian DLA-2699-1 : ipmitool - LTS security update 
 VRVDR-55600 9.8 DLA-2695-1 CVE-2021-31870, CVE-2021-31871, CVE-2021-31872, CVE-2021-31873: Debian DLA-2695-1 : klibc - LTS security update 
 VRVDR-55556 7.8 DLA-2694-1 CVE-2020-35523, CVE-2020-35524: Debian DLA-2694-1 : tiff security update 
 VRVDR-55555 5.7 DLA-2692-1 CVE-2020-26558, CVE-2021-0129: Debian DLA-2692-1 : bluez security update 
 VRVDR-55537 7.5 DLA-2691-1 CVE-2021-33560: Debian DLA-2691-1 : libgcrypt 
 VRVDR-55273 6.5 DLA-2669-1 CVE-2021-3541: Debian DLA-2669-1 : libxml2 security update
VRVDR-57003 9.8 DLA-2919-1 CVE-2021-3177, CVE-2021-4189: Debian DLA-2919-1 : python2.7 -LTS security update 
 VRVDR-56955 7.5 DLA-2898-1 CVE-2022-22747: Debian DLA-2898-1 : nss-LTS security update 
 VRVDR-56954 9.8 DLA-2904-1 CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827, CVE-2022-23852, CVE-2022-23990: Debian DLA-2904-1 : expat -LTS security update 
 VRVDR-56903 9.1 DSA-5056-1 CVE-2021-45079: Debian DSA-5056-1: strongswan–security update 









 1912t 



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912t

 Issue Number CVSS score Advisory Summary 

 VRVDR-56909 7.8 N/A CVE-2021-4034: policykit-1 security update 









 1912s 



 Issues Resolved 



Issues resolved for 1912s

 Issue Number Priority Summary 

 VRVDR-56188 Critical bgpd dumps core in as_list_apply() 
 VRVDR-56672 Critical SNAT SIP ALG misinterprets SDP part of packet payload header causing dataplane crash 
 VRVDR-56576 Critical Dataplane crash while capturing traffic 
 VRVDR-56131 Blocker ping/ssh from remote server to device connected to s9500 SIAD fails, but reachable locally 
 VRVDR-47554 Major Validate GRE tunnel transport local-ip 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912s

 Issue Number CVSS score Advisory Summary
VRVDR-47824 Critical Got bridge sw0 does not exist message with XS running in Blinkboot BIOS mode 
 VRVDR-47814 Critical system ip gratuitous-arp not setting policy 
 VRVDR-47809 Major Configd does not expand grouping defined under a nested augment 
 VRVDR-47807 Major SIAD loses OSPFv3 neighbours periodically for 180s 
 VRVDR-47624 Blocker PTP fails to start with PTP config present at bootup 
 VRVDR-47481 Critical PTP with 2 slaves dataplane crash in bcm_ptp_unicast_slave_subscribe 
 VRVDR-47391 Blocker PTP fails to return to time-locked state after master clock stopped and re-started 
 VRVDR-47244 Critical dataplane crash on restart - no code changes 
 VRVDR-41129 Blocker Journalbeat can't export logs to destination in routing instance 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908a

 Issue Number CVSS score Advisory Summary 

 VRVDR-48074 9.8 DSA-4506-1 CVE-2018-20815, CVE-2019-13164, CVE-2019- 14378: Debian DSA-4506-1 : qemu - security update 
 VRVDR-47707 7.8 DSA-4484-1 CVE-2019-13272: Debian DSA-4484-1: linux security update 









 1801zf 



 Issues Resolved 



Issues resolved for 1801zf

 Issue Number Priority Summary 

 VRVDR-50956 Critical VRRP goes into fault state after reboot 
 VRVDR-49924 Blocker Commit failed in IPsec site-to-site configuration 
 VRVDR-49760 Major VRRP Failover happens when one of the interfaces in bonding group is physically UP 
 VRVDR-49737 Major GUI displays wrong/different information than CLI 
 VRVDR-49707 Major vyatta-openvpn: code injection due to scripts in tmplscripts
VRVDR-48720 Critical PTP: assert in IDTStackAdaptor_UpdateBestMasterSelection 
 VRVDR-48660 Critical No rotation occuring for /var/log/messages 
 VRVDR-48585 Major ICMP Unreachable not returned when decrypted IPsec packet is too large to pass tunnel interface MTU 
 VRVDR-48461 Critical SNMP Not working in 1908a 
 VRVDR-47203 Major 1903d yang package fatal error 
 VRVDR-47002 Minor PTP: network information is not cleared from disabled (skipped) ports during reconfiguration 
 VRVDR-44104 Blocker Creating a switch interface doesn't work with QinQ 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908d

 Issue Number CVSS score Advisory Summary 

 VRVDR-49486 5.3 DSA-4594-1 CVE-2019-1551: Debian DSA-4594-1 : openssl1.0 - security update 
 VRVDR-49477 7.5 DSA-4591-1 CVE-2019-19906: Debian DSA-4591-1 : cyrus-sasl2 - security update 
 VRVDR-49450 9.8 DSA-4587-1 CVE-2019-15845, CVE-2019-16201, CVE-2019- 16254, CVE-2019-16255: Debian DSA-4587-1 : ruby2.3 - security update 
 VRVDR-49155 7.2 N/A CVE-2018-5265: Devices allow remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta- cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters. 
 VRVDR-48691 7.5 DSA-4544-1 CVE-2019-16866: Debian DSA-4544-1: unbound - security update
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) 
 VLAN Protection ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) !
VRVDR-56672 Critical SNAT SIP ALG misinterprets SDP part of packet payload header causing dataplane crash 
 VRVDR-56576 Critical Dataplane crash while capturing traffic 
 VRVDR-56131 Blocker ping/ssh from remote server to device connected to s9500 SIAD fails, but reachable locally 
 VRVDR-47554 Major Validate GRE tunnel transport local-ip 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912s

 Issue Number CVSS score Advisory Summary 

 VRVDR-56769 8.1 DLA-2848-1 CVE-2019-13115, CVE-2019-17498 :Debian DLA-2848-1 : libssh2 - LTS security update 
 VRVDR-56689 9.8 DLA-2836-1 CVE-2021-43527: Debian DLA-2836-1 : nss - LTS security update 
 VRVDR-56680 7.5 DLA-2837-1 CVE-2021-43618: DLA-2837-1 : gmp - LTS security update 
 VRVDR-56665 9.8 DLA-2834-1 CVE-2018-20721: Debian DLA-2834-1 : uriparser - LTS security update 
 VRVDR-56664 7.5 DLA-2833-1 CVE-2018-5764: Debian DLA-2833-1 : rsync - LTS security update 
 VRVDR-56647 8.8 DLA-2827-1 CVE-2019-8921, CVE-2019-8922, CVE-2021-41229: Debian DLA-2827-1 : bluez - LTS security update 
 VRVDR-56645 8.8 DLA-2828-1 CVE-2017-14160, CVE-2018-10392, CVE-2018-10393: Debian DLA-2828-1 : libvorbis - LTS security update
VRVDR-39177 Major OpenVPN server domain-name option not being applied with –push dhcp-option 
 VRVDR-39129 Critical OpenVPN server push-route parameter causes OpenVPN to fail to start 









 5.2R6S1 

Released October 12, 2017.



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved in 5.2R6S1

 Issue Number CVSS score Advisory Summary 

 VRVDR- 38819 9.8 DSA-3989-1 CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE- 2017-14494, CVE-2017-14495, CVE-2017-14496: DSA- 3989-1 dnsmasq -- security update