Stemcell v1709.x (Windows Server version 1709) Release Notes

This topic includes release notes for Windows stemcells used with VMware Tanzu Application Service for VMs [Windows] (TAS for VMs [Windows]).

To download a stemcell, see Stemcells (Windows) on the Broadcom Support portal.

Note The Windows stemcell v1709.x line is compatible with Tanzu Application Service [Windows] v2.1 and v2.2.

1709.21

Release Date: May 30, 2019

Security Fix

Based on Microsoft’s guidance, additional fixes to protect against speculative execution side-channel vulnerabilities

1709.21

Release Date: May 23, 2019

Features

Platform Engineers can deploy Windows Stemcells on a BOSH Director with Google Cloud Storage as their external Blobstore.
Improved Troubleshooting of Windows VMs, with ssh enabled by default for all Windows VMs. You can still disable SSH in the PASW tile.

1709.20

### Features

Intended for use with April 2019 Microsoft Security Updates

1709.19

### Features

Includes March 2019 Microsoft Security Updates.

### Bug Fix

Disabled additional configuration related to NetBios. See the Pivotal Tracker story.

1709.18

Release Date: March 1, 2019

[Patches] Included February Patch Tuesday Microsoft Security Updates.

1709.17

Release Date: January 24, 2019

[Patches] Included January Patch Tuesday Microsoft Security Updates.
Added fix for mitigating CVE-2018-3639.

1709.16

Release Date: December 24, 2018

Features

[Patches] Included December Patch Tuesday Microsoft Security Updates.
Added the BOSH API version in the stemcell to surface more information about the compatibility of the stemcell with BOSH.

Bug Fix

BOSH release job symlinks were not getting cleaned up when a target folder was removed. This issue is resolved.

1709.15

Release Date: November 28, 2018

Features

[Security] Disabled use of TLS 1.0 by SSL/TLS server and client.
[Security] Disabled RC4.
[Security] Disabled triple-DES cipher to mitigate against Sweet32: Birthday attacks on 64-bit block ciphers in TLS.
[Patches] Intended for use with November 2018 Patch Tuesday Microsoft Security Updates.
[New IaaS Support] Added support for AWS GovCloud.

1709.14

Release Date: October 30, 2018

Features

Intended for use with October 2018 Microsoft Security Updates.
Disables RDP by default to improve security of the 1709 stemcells. You can still enable RDP through the PASW Tile Configuration.

Bug Fix

Intermittent “Access denied” errors occur during the compilation phase of PASW deployments. We have added a fix to potentially resolve them.
Fixed the Ephemeral Disk Provisioning for Azure enabling compatibility of PASW’s ephemeral disk functionality with OpsMgr on Azure.

1709.13

Release Date: September 24, 2018

Features

Includes ephemeral disk support. This enables you to configure the size of your Windows cells in the PAS for Windows tile. For more information, see the Configure Tile Resources section in Installing and Configuring PAS for Windows.
Intended for use with September 2018 Microsoft Security Updates.

Bug Fix

Previously, the os_version argument was mandatory during the Invoke-Sysprep step. The OS is now detected by default, and the os_version argument is optional.

Known Issues

For Google Cloud Platform (GCP) users, a bug in PASW causes outbound connections from applications deployed on PASW with this stemcell version to fail. The resolution will come in patch versions of PASW v2.1, v2.2 and v2.3.

1709.12

Release Date: August 27, 2018

Features

Intended for use with the August 2018 Microsoft Security Updates.
Includes an important Microsoft Security Update that provides protections against a new speculative execution side-channel vulnerability known as L1 Terminal Fault (L1TF). For more information, see Windows Support.
Compatible with the latest stable OpenSSH version, OpenSSH_for_Windows_v7.7.2.0p1-Beta. This version fixed the issue of OpenSSH logs filling up the disk.

Bug Fix

Deployment of PASW fails due to “Access is Denied” error during compilation of packages on the Windows VM.

1709.11

Release Date: August 2, 2018

Features

This is the first official release of the 1709 stemcell for Amazon Web Services (AWS). PASW can be deployed on AWS going forward.

Improvements

This release incorporates Patch Tuesday July 2018 security updates.

Bug Fix

Previously, when operators selected the Encrypt Linux EBS Volumes checkbox in the IaaS-specific configuration section of the BOSH Director tile, the deployment of PASW would fail.

This release enables operators to select the Encrypt Linux EBS Volumes checkbox without the deployment of PASW failing. However, only Linux VMs will be encrypted, not Windows VMs.