New maintenance update candidates for XCP-ng 8.3 LTS
This update is focused on security fixes.
What changed
edk2:
Sync with XenServer edk2-20220801-1.7.13. The update fixes vulnerabilities allowing an unauthenticated attacker on the local network to compromise a VM during PXE boot, or enable a guest VM administrator to bypass Secure Boot. See below the list of the corresponding CVEs:
CVE-2026-97631
CVE-2024-38796
CVE-2024-38797
CVE-2019-14560
CVE-2022-36763
CVE-2022-36764
CVE-2026-45447
CVE-2026-111497
Versions
edk2: 20220801-1.7.11.2.xcpng8.3 -> 20220801-1.7.13.1.xcpng8.3
Test on XCP-ng 8.3
yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
reboot # not mandatory but recommended for testing
The usual update rules apply: pool coordinator first, etc.
What to test
As usual, normal use and anything else you want to test.
Additionally, a cold boot (shutdown and start) of the UEFI VMs would also help testing the edk2 fix.
Test window before official release of the updates
4 days
We would like to thank users who shared feedback since our last call for testing: @acebmxer, @jr-m4, @bufanda, @flakpyro, @Andrew, @MajorP93, @JeffBerntsen, @manilx, @XCP-ng-JustGreat, @john205, @Greg_E.
We are aware of the frequency of these updates and strive to batch packages as much as possible. However, recent unplanned security updates require immediate attention. While drafting this message, we received another security update that we will release shortly.
