Nomad - v1.4.11

1.4.11 (July 18, 2023)

SECURITY:

• acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. CVE-2023-3072 [GH-17908]
• search: Fixed a bug where ACL did not filter plugin and variable names in search endpoint. CVE-2023-3300 [GH-17906]
• sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs CVE-2023-3299 [GH-17907]

IMPROVEMENTS:

• cli: Add -quiet flag to nomad var init command [GH-17526]
• cni: Ensure to setup CNI addresses in deterministic order [GH-17766]
• deps: Updated Vault SDK to 0.9.0 [GH-17281]
• deps: update docker to 23.0.3 [GH-16862]

BUG FIXES:

• api: Fixed a bug that caused a panic when calling the Jobs().Plan() function with a job missing an ID [GH-17689]
• api: add missing constant for unknown allocation status [GH-17726]
• api: add missing field NetworkStatus for Allocation [GH-17280]
• cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed [GH-17535]
• cli: Output error messages during deployment monitoring [GH-17348]
• client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels [GH-17625]
• client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly [GH-17349]
• consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens [GH-17847]
• core: Fix panic around client deregistration and pending heartbeats [GH-17316]
• core: fixed a bug that caused job validation to fail when a task with kill_timeout was placed inside a group with update.progress_deadline set to 0 [GH-17342]
• csi: Fixed a bug where CSI volumes would fail to restore during client restarts [GH-17840]
• identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy [GH-17018]
• replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. [GH-17476]
• scheduler: Fixed a bug that could cause replacements for failed allocations to be placed in the wrong datacenter during a canary deployment [GH-17653]
• scheduler: Fixed a panic when a node has only one configured dynamic port [GH-17619]
• ui: dont show a service as healthy when its parent allocation stops running [GH-17465]