v249

The cf-release v249 was released on December 10, 2016.

Important

• This release patches
  • CVE-2016-6659 UAA Privilege Escalation
  • CVE-2016-6816 Apache Tomcat Information Disclosure, UAA Tomcat updated to 8.0.39
• This release has a known issue that login.saml.serviceProviderKeyPassword need to be set to "" explicitly if the login.saml.serviceProviderKey is not passphrase protected. This will be addressed in the next release.

login.saml.serviceProviderKeyPassword:
description: "Password to protect the service provider private key."

Contents:

• CC and Service Broker APIs
• Identity
• Routing
• Loggregator
• Buildpacks and Stacks
• DEA-Warden-HM9000 Runtime
• Internal Components
• Recommended Versions of Additional Releases
• Job Spec Changes
• Recommended BOSH Stemcell Versions

CC and Service Broker APIs

Contains CAPI release v1.11.0. Release notes for v1.11.0

Identity

UAA Release bumped to v24 aka UAA Release v3.9.3

Routing

Routing-release was bumped to 0.142.0

Loggregator

This section will be updated soon. If this section is not yet up-to-date, please reach out for information:

• Updated to golang 1.7.4
• Improved Cipher Suites
• Update to TLS versions being used

Buildpacks and Stacks

• No changes

DEA-Warden-HM9000 Runtime

• No changes

Internal Components

postgres-release (includes postgres job)

• No changes

etcd-release (includes etcd and etcd_metrics_server jobs)

• Bumped from v86 to v87. Functional changes:
  The proxy for TLS migration now responds to /v2/members, fixing an issue in consumers that get peers via the API instead of via bosh properties.

consul-release (includes consul_agent job)

• No changes.

nats-release (includes nats and nats_stream_forwarder jobs)

• No changes.

Recommended Versions of Additional Releases

These versions are soft recommendations, as several different versions of these releases may work correctly with this version of cf-release.

• Diego release v1.2.0.
  Release notes for
  v1.2.0 ·
  v1.1.0.
• Garden-Runc release v1.04.
  Release notes for
  v1.0.4 ·
  v1.0.3.
• cflinuxfs2-rootfs release v1.41.0.
  Release notes for
  v1.41.0 ·
  v1.40.0.

Job Spec Changes

Recommended BOSH Stemcell Versions

• real IaaS: 3312.7
• BOSH-Lite: 3312.7

Note: For AWS you should use the Xen-HVM stemcells rather than Xen.

These are soft recommendations; several different versions of the stemcells are likely to work fine with this version of cf-release and the corresponding versions of the additional releases listed above.