Synopsis

nftables bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

An update for nftables is now available for Red Hat Enterprise Linux 7.

Description

nftables provides a packet-filtering tool, with numerous improvements in convenience, features, and performance. It is the designated successor to iptables, ip6tables, arptables and ebtables.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Users of nftables are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

• BZ - 1374754 - TestOnly: [RFE] better keyword for pkt_type matches
• BZ - 1504157 - Fix Covscan detected programming errors
• BZ - 1540917 - nft map with ipv6 address type key and integer type value can not be added
• BZ - 1571938 - nftables: man page gives wrong keyword for "reject with icmp6"
• BZ - 1571968 - nftables: man page implies "insert ... position ..." uses a rule offset
• BZ - 1575059 - past nftables in EPEL7 had a Epoch, nftables in RHEL7.5 does not
• BZ - 1576426 - adding element to nft sets with flag "interval" and concatenation results in error

CVEs

(none)

References