From 44ef76e5e97d9f989ddc9194627b5bf62128ffd1 Mon Sep 17 00:00:00 2001 From: Ondrej Patocka <80347071+ondrejpatocka@users.noreply.github.com> Date: Mon, 13 Oct 2025 08:58:36 +0200 Subject: [PATCH 1/2] PMM-14344 - 3.4.1 RN PMM-14344 - 3.4.1 RN --- sources/metadata/pmm-server/3.4.0.yaml | 8 ++-- sources/metadata/pmm-server/3.4.1.yaml | 6 +++ sources/release-notes/pmm/3.4.1.md | 51 ++++++++++++++++++++++++++ 3 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 sources/metadata/pmm-server/3.4.1.yaml create mode 100644 sources/release-notes/pmm/3.4.1.md diff --git a/sources/metadata/pmm-server/3.4.0.yaml b/sources/metadata/pmm-server/3.4.0.yaml index f3a94d64..ad83713b 100644 --- a/sources/metadata/pmm-server/3.4.0.yaml +++ b/sources/metadata/pmm-server/3.4.0.yaml @@ -1,6 +1,6 @@ version: 3.4.0 imageInfo: - image_path: "perconalab/pmm-server:3-dev-latest" - image_hash: "sha256:sha256:c6610c784321239cceee623b57378d011248886092fce050a1867d65f8747f22" - image_release_timestamp: "2025-07-30T13:50:00.000000Z" - status: "available" + image_path: "perconalab/pmm-server:3.4.0" + image_hash: "sha256:53db419c81b53439976d4e1bba6154723b01377b54ae95e80dbe338d2c321e0a" + image_release_timestamp: "2025-09-15T12:09:52.343594Z" + status: "available" \ No newline at end of file diff --git a/sources/metadata/pmm-server/3.4.1.yaml b/sources/metadata/pmm-server/3.4.1.yaml new file mode 100644 index 00000000..b84e5587 --- /dev/null +++ b/sources/metadata/pmm-server/3.4.1.yaml @@ -0,0 +1,6 @@ +version: 3.4.1 +imageInfo: + image_path: "perconalab/pmm-server:3.4.1" + image_hash: "sha256:53db419c81b53439976d4e1bba6154723b01377b54ae95e80dbe338d2c321e0a" + image_release_timestamp: "2025-10-13T10:09:52.343594Z" + status: "available" \ No newline at end of file diff --git a/sources/release-notes/pmm/3.4.1.md b/sources/release-notes/pmm/3.4.1.md new file mode 100644 index 00000000..dfaab216 --- /dev/null +++ b/sources/release-notes/pmm/3.4.1.md @@ -0,0 +1,51 @@ +## Release summary + +PMM 3.4.1 is a maintenance release that addresses several security vulnerabilities and dependency upgrades to enhance stability and safety. + +## Security updates + +### Nomad vulnerability (CVE-2025-8959) + +PMM includes Nomad, which is currently affected by a high-severity DoS vulnerability originating from Go crypto library. + +Since Nomad is disabled by default in PMM, the vulnerability has minimal risk for typical deployments. Keep Nomad disabled to maintain this protection. + +We have upgraded Nomad to v1.10.5 and continue monitoring the upstream project. Once a fully patched version becomes available, we will integrate the fix into an upcoming PMM release. + +### Fixed: DoS in Percona Toolkit (Logrus) + +Upgraded Percona Toolkit to v3.7.0-2 to resolve a high-severity DoS vulnerability found in the `github.com/sirupsen/logrus` dependency. This flaw could previously crash Percona Toolkit commands and disrupt PMM data collection. + +### Reported CVE issues (false positives) + +Security scanning tools may report the following CVEs as affecting PMM 3.4.1. After thorough investigation, we have determined that PMM is not affected by these vulnerabilities: + +#### OpenSSL cipher processing vulnerability (CVE-2023-5363) + +PMM is not affected by this OpenSSL cipher processing vulnerability because `openssl-libs` package in the Oracle Linux 9 base OS already includes the security fix. + +Verified against the [Oracle Linux security advisory ELSA-2024-0627](https://linux.oracle.com/errata/ELSA-2024-0627.html). + +#### Remote code execution (RCE) in pypa/setuptools (CVE-2024-6345) + +PMM is not affected by this RCE vulnerability. + +The PMM image's base OS, Oracle Linux 9, ships with `python3-setuptools 53.0.0-13.el9_6.1`, which already contains the necessary security patch, confirmed in the [Oracle Linux security advisory ELSA-2024-5534](https://linux.oracle.com/errata/ELSA-2024-5534.html). + +#### ClickHouse vulnerabilities related to Go 1.19.10 (CVE-2024-24790) + +This release also addresses vulnerabilities discovered in ClickHouse v23.8.2.7, the database engine integrated into PMM for storing performance metrics. + +The vulnerabilities originated from an older version of Go (1.19.10) used within ClickHouse and affect the `clickhouse-diagnostics` utility, a diagnostic utility that PMM does not use. + +To fully eliminate potential exposure, we have removed the `clickhouse-diagnostics` package from the PMM 3.4.1. As a result, PMM is not affected by these vulnerabilities. + +We plan a full ClickHouse version upgrade in PMM 3.5.0, which will include an updated Go runtime. + +### Accepted risk: OpenSSL buffer overflow vulnerabilities (CVE-2022-3786 and CVE-2022-3602) + +These vulnerabilities affect the `openssl-libs` package that comes with PMM's Oracle Linux 9 base image. + +Oracle has released patches for these vulnerabilities, but they are distributed only through Oracle Ksplice, their live patching service for Premier Support subscriptions. Because PMM uses only publicly available repositories, these Ksplice-only updates cannot be included. + +We assess this risk as low, as PMM is usually deployed in controlled environments. We will apply the updates as soon as Oracle releases them publicly for Oracle Linux. \ No newline at end of file From 5ed1b3542c93516a396ecf98b1d45895a8273283 Mon Sep 17 00:00:00 2001 From: Ondrej Patocka <80347071+ondrejpatocka@users.noreply.github.com> Date: Mon, 13 Oct 2025 09:22:59 +0200 Subject: [PATCH 2/2] New line fix --- sources/metadata/pmm-server/3.4.1.yaml | 2 +- sources/release-notes/pmm/3.4.1.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources/metadata/pmm-server/3.4.1.yaml b/sources/metadata/pmm-server/3.4.1.yaml index b84e5587..7cee8fed 100644 --- a/sources/metadata/pmm-server/3.4.1.yaml +++ b/sources/metadata/pmm-server/3.4.1.yaml @@ -3,4 +3,4 @@ imageInfo: image_path: "perconalab/pmm-server:3.4.1" image_hash: "sha256:53db419c81b53439976d4e1bba6154723b01377b54ae95e80dbe338d2c321e0a" image_release_timestamp: "2025-10-13T10:09:52.343594Z" - status: "available" \ No newline at end of file + status: "available" diff --git a/sources/release-notes/pmm/3.4.1.md b/sources/release-notes/pmm/3.4.1.md index dfaab216..c529bbd7 100644 --- a/sources/release-notes/pmm/3.4.1.md +++ b/sources/release-notes/pmm/3.4.1.md @@ -48,4 +48,4 @@ These vulnerabilities affect the `openssl-libs` package that comes with PMM's Or Oracle has released patches for these vulnerabilities, but they are distributed only through Oracle Ksplice, their live patching service for Premier Support subscriptions. Because PMM uses only publicly available repositories, these Ksplice-only updates cannot be included. -We assess this risk as low, as PMM is usually deployed in controlled environments. We will apply the updates as soon as Oracle releases them publicly for Oracle Linux. \ No newline at end of file +We assess this risk as low, as PMM is usually deployed in controlled environments. We will apply the updates as soon as Oracle releases them publicly for Oracle Linux.