RC - 3.4.1 RN

sources/metadata/pmm-server/3.4.0.yaml

@@ -1,6 +1,6 @@
 version: 3.4.0
 imageInfo:
-  image_path: "perconalab/pmm-server:3-dev-latest"
-  image_hash: "sha256:sha256:c6610c784321239cceee623b57378d011248886092fce050a1867d65f8747f22"
-  image_release_timestamp: "2025-07-30T13:50:00.000000Z"
-  status: "available"
+  image_path: "perconalab/pmm-server:3.4.0"
+  image_hash: "sha256:53db419c81b53439976d4e1bba6154723b01377b54ae95e80dbe338d2c321e0a"
+  image_release_timestamp: "2025-09-15T12:09:52.343594Z"
+  status: "available"

sources/metadata/pmm-server/3.4.1.yaml

@@ -0,0 +1,6 @@
+version: 3.4.1
+imageInfo:
+  image_path: "perconalab/pmm-server:3.4.1"
+  image_hash: "sha256:53db419c81b53439976d4e1bba6154723b01377b54ae95e80dbe338d2c321e0a"
+  image_release_timestamp: "2025-10-13T10:09:52.343594Z"
+  status: "available"

sources/release-notes/pmm/3.4.1.md

@@ -0,0 +1,51 @@
+## Release summary
+
+PMM 3.4.1 is a maintenance release that addresses several security vulnerabilities and dependency upgrades to enhance stability and safety.
+
+## Security updates
+
+### Nomad vulnerability (CVE-2025-8959)
+
+PMM includes Nomad, which is currently affected by a high-severity DoS vulnerability originating from Go crypto library.
+
+Since Nomad is disabled by default in PMM, the vulnerability has minimal risk for typical deployments. Keep Nomad disabled to maintain this protection.
+
+We have upgraded Nomad to v1.10.5 and continue monitoring the upstream project. Once a fully patched version becomes available, we will integrate the fix into an upcoming PMM release.
+
+### Fixed: DoS in Percona Toolkit (Logrus)
+
+Upgraded Percona Toolkit to v3.7.0-2 to resolve a high-severity DoS vulnerability found in the `github.com/sirupsen/logrus` dependency. This flaw could previously crash Percona Toolkit commands and disrupt PMM data collection.
+
+### Reported CVE issues (false positives)
+
+Security scanning tools may report the following CVEs as affecting PMM 3.4.1. After thorough investigation, we have determined that PMM is not affected by these vulnerabilities:
+
+#### OpenSSL cipher processing vulnerability (CVE-2023-5363)
+
+PMM is not affected by this OpenSSL cipher processing vulnerability because `openssl-libs` package in the Oracle Linux 9 base OS already includes the security fix.
+
+Verified against the [Oracle Linux security advisory ELSA-2024-0627](https://linux.oracle.com/errata/ELSA-2024-0627.html).
+
+#### Remote code execution (RCE) in pypa/setuptools (CVE-2024-6345)
+
+PMM is not affected by this RCE vulnerability.
+
+The PMM image's base OS, Oracle Linux 9, ships with `python3-setuptools 53.0.0-13.el9_6.1`, which already contains the necessary security patch, confirmed in the [Oracle Linux security advisory ELSA-2024-5534](https://linux.oracle.com/errata/ELSA-2024-5534.html).
+
+#### ClickHouse vulnerabilities related to Go 1.19.10 (CVE-2024-24790)
+
+This release also addresses vulnerabilities discovered in ClickHouse v23.8.2.7, the database engine integrated into PMM for storing performance metrics.
+
+The vulnerabilities originated from an older version of Go (1.19.10) used within ClickHouse and affect the `clickhouse-diagnostics` utility, a diagnostic utility that PMM does not use.
+
+To fully eliminate potential exposure, we have removed the `clickhouse-diagnostics` package from the PMM 3.4.1. As a result, PMM is not affected by these vulnerabilities.
+
+We plan a full ClickHouse version upgrade in PMM 3.5.0, which will include an updated Go runtime.
+
+### Accepted risk: OpenSSL buffer overflow vulnerabilities (CVE-2022-3786 and CVE-2022-3602)
+
+These vulnerabilities affect the `openssl-libs` package that comes with PMM's Oracle Linux 9 base image.
+
+Oracle has released patches for these vulnerabilities, but they are distributed only through Oracle Ksplice, their live patching service for Premier Support subscriptions. Because PMM uses only publicly available repositories, these Ksplice-only updates cannot be included.
+
+We assess this risk as low, as PMM is usually deployed in controlled environments. We will apply the updates as soon as Oracle releases them publicly for Oracle Linux.