This is an automated email from the ASF dual-hosted git repository.
DaanHoogland pushed a commit to branch staging-site
in repository https://gitbox.apache.org/repos/asf/cloudstack-www.git
The following commit(s) were added to refs/heads/staging-site by this push:
new d1ce956d4 20.3 and 22.1 sec releases #1 (#449)
d1ce956d4 is described below
commit d1ce956d416fa7da39ff15440061c4a11c2e1fcd
Author: dahn <[email protected]>
AuthorDate: Fri Aug 21 09:56:19 2026 +0200
20.3 and 22.1 sec releases #1 (#449)
Co-authored-by: Abhishek Kumar <[email protected]>
Co-authored-by: Daan Hoogland <[email protected]>
---
.../banner.png | Bin 0 -> 514428 bytes
.../index.md | 595 +++++++++++++++++++++
src/components/Releases/index.tsx | 2 +
src/pages/downloads.mdx | 32 +-
4 files changed, 613 insertions(+), 16 deletions(-)
diff --git
a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/banner.png
b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/banner.png
new file mode 100644
index 000000000..ee2c01c90
Binary files /dev/null and
b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/banner.png differ
diff --git
a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
new file mode 100644
index 000000000..a0465384a
--- /dev/null
+++ b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
@@ -0,0 +1,595 @@
+---
+layout: post
+title: "[ADVISORY] Apache CloudStack LTS Security Releases 4.20.3.1 and
4.22.1.1"
+tags: [announcement]
+authors: [daan]
+slug: security-release-advisory-4.20.3.1-4.22.1.1
+---
+
+[](/blog/security-release-advisory-4.20.3.1-4.22.1.1)
+
+The Apache CloudStack project announces the release of LTS releases
[4.20.3.1](https://github.com/apache/cloudstack/releases/tag/4.20.3.1) and
[4.22.1.1](https://github.com/apache/cloudstack/releases/tag/4.22.1.1) that
address the following security issues:
+
+- CVE-2026-47359 (severity 'Low')
+- CVE-2026-50112 (severity 'Critical')
+- CVE-2026-50222 (severity 'Important')
+- CVE-2026-59085 (severity 'Moderate')
+- CVE-2026-59655 (severity 'Moderate')
+- CVE-2026-59657 (severity 'Low')
+- CVE-2026-59780 (severity 'Low')
+- CVE-2026-59799 (severity 'Important')
+- CVE-2026-61397 (severity 'Critical')
+- CVE-2026-61398 (severity 'Low')
+- CVE-2026-61399 (severity 'Low')
+- CVE-2026-61400 (severity 'Low')
+- CVE-2026-61422 (severity 'Low')
+- CVE-2026-62440 (severity 'Important')
+- CVE-2026-65613 (severity 'Moderate')
+- CVE-2026-66721 (severity 'Moderate')
+- CVE-2026-66722 (severity 'Moderate')
+- CVE-2026-66797 (severity 'Low')
+- CVE-2026-68745 (severity 'Important')
+
+
+<!-- truncate -->
+
+## [CVE-2026-47359](https://www.cve.org/CVERecord?id=CVE-2026-47359): OS
Command Injection due to unsanitized mount command
+
+Improper Neutralization of Special Elements used in an OS Command ('OS
+Command Injection') vulnerability in Apache CloudStack's NAS backup
+provider plugin. The addBackupRepository API (available since
+4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0)
+accept unsanitized command options for the backup repository. A
+malicious operator account can exploit this to inject arbitrary
+commands that execute on the KVM hypervisor host when any account
+subsequently performs a backup restore.
+
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - 김우석 <[email protected]> (reporter)
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.20.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+## [CVE-2026-50112](https://www.cve.org/CVERecord?id=CVE-2026-50112): RCE and
SSRF in direct download, metalink and NFS templates
+
+##### SSRF via Metalink Mirror URL Resolution:
+
+An authenticated tenant can register a template pointing to an
+attacker-controlled metalink file containing internal targets. The
+Secondary Storage VM will retrieve the data and persist it as a
+template file, which can later be downloaded through normal APIs.
+
+##### RCE on KVM hypervisor via NFS, Metalink files with/without Direct
Downloads:
+
+An authenticated CloudStack tenant holding the default User role can
+execute arbitrary shell commands as root on the KVM hypervisor host
+that runs other tenants' VMs. This is cross-tenant root on the
+underlying compute, reachable via the public CloudStack API.
+
+When a User registers a VM template with directDownload=true and a URL
+pointing to a .metalink file, the management server fetches the
+metalink XML and dispatches download to the KVM agent. Inner URLs
+inside the metalink XML are never re-validated against the scheme
+allowlist.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - K (reporter)
+ - Samy Ghannad <[email protected]> (reporter)
+ - Katriel Moses <[email protected]> (reporter)
+ - Venkatraman Kumar <[email protected]> (reporter)
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.14.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+## [CVE-2026-50222](https://www.cve.org/CVERecord?id=CVE-2026-50222): Improper
access control in Userdata reference APIs
+
+Missing Authorization, Exposure of Sensitive Information to an
+Unauthorized Actor vulnerability in Apache CloudStack's Userdata
+reference APIs.
+
+Several userdata-related APIs in Apache CloudStack, including
+deleteUserData, linkUserDataToTemplate,
+resetUserDataForVirtualMachine, deployVirtualMachine, and
+updateVirtualMachine, exhibit missing or insufficient access control
+validation, potentially allowing cross-tenant/cross-account access to
+userdata resources that belong to other tenants.
+
+The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits
+similar behaviour and lacks access validation.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Bernardo De Marco Gonçalves <[email protected]> (reporter)
+ - Yuliang Xiao <[email protected]> (reporter)
+ - Łukasz Bawolski <[email protected]> (reporter)
+ - George Chen (GitHub: geo-chen) (reporter)
+ - KQ Wu <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.18.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+## [CVE-2026-59085](https://www.cve.org/CVERecord?id=CVE-2026-59085):
Server-Side Request Forgery (SSRF) vulnerability in webhook module
+
+Server-Side Request Forgery (SSRF) vulnerability in Apache
+CloudStack's webhook module, exploitable via webhook delivery
+requests.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Jonathan Leitschuh <[email protected]> (reporter)
+ - Łukasz Bawolski <[email protected]> (reporter)
+ - George Chen (GitHub: geo-chen) (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.20.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-59655](https://www.cve.org/CVERecord?id=CVE-2026-59655):
Unauthenticated OAuth provider client-secret disclosure
+
+Exposure of Sensitive Information to an Unauthorized Actor
+vulnerability in Apache CloudStack's OAuth authentication plugin while
+listing OAuth providers.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Yuliang Xiao <[email protected]> (reporter)
+ - Stijn Simons <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.19.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-59657](https://www.cve.org/CVERecord?id=CVE-2026-59657):
Sensitive Information Disclosure via Cleartext Storage in AsyncJob
+
+Cleartext Storage of Sensitive Information vulnerability in Apache
+CloudStack with AsyncJob storage in the database.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Davi Torres <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-59780](https://www.cve.org/CVERecord?id=CVE-2026-59780): LDAP
provider configuration disclosure
+
+Exposure of Sensitive Information to an Unauthorized Actor
+vulnerability in Apache CloudStack's LDAP authentication plugin while
+listing LDAP providers.
+
+LDAP configurations can be listed by any authenticated user with
+access to the listLdapConfigurations API. By default, this API is
+available to all default roles.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.2.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-59799](https://www.cve.org/CVERecord?id=CVE-2026-59799): Missing
Privilege Check in Two-Factor Authentication Disable Flow
+
+Improper Privilege Management vulnerability in Apache CloudStack's
+Two-factor authentication plugin allowing bypass of the two-factor
+authentication disable flow.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Erichen <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.18.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-61397](https://www.cve.org/CVERecord?id=CVE-2026-61397): OAuth2
Token Cross-Request Leak
+
+Exposure of Sensitive Information to an Unauthorized Actor
+vulnerability in Apache CloudStack's OAuth2 authentication plugin and
+Google OAuth integration.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Katriel Moses <[email protected]> (reporter)
+ - "Network and Cloud Laboratory (NaCl) KMITL" <[email protected]> (reporter)
+ - Paratpanu Pechsaman <[email protected]> (analyst)
+ - Nutthawat Charoensiriphong <[email protected]> (analyst)
+ - Panabordee Panitchakit <[email protected]> (analyst)
+
+### Affected versions:
+
+ - Apache CloudStack 4.19.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-61398](https://www.cve.org/CVERecord?id=CVE-2026-61398):
Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in
UI
+
+Improper Encoding or Escaping of Output vulnerability in Apache
+CloudStack's UI while using Instance Reset Password functionality.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.15.1.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-61399](https://www.cve.org/CVERecord?id=CVE-2026-61399):
Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
+
+Improper Encoding or Escaping of Output vulnerability in Apache
+CloudStack's UI while using Lock User Functionality.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.20.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-61400](https://www.cve.org/CVERecord?id=CVE-2026-61400): Get and
Run Diagnostics Command Injection
+
+Improper Neutralization of Special Elements used in a Command
+('Command Injection') vulnerability in Apache CloudStack's run and get
+diagnostics functionality for the system VMs and virtual routers.
+
+An authenticated user holding the permissions required to invoke
+either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary
+command execution on the system VM and/or Virtual Router instances,
+with commands running as root (or as the diagnostics-process user, at
+minimum). This represents a full compromise of the affected instance
+and, depending on network segmentation, may provide a foothold for
+lateral movement within the CloudStack-managed infrastructure,
+including access to guest network traffic handled by the compromised
+Virtual Router.
+
+The getDiagnosticsData and runDiagnostics APIs are restricted to only
+Admin role accounts by default.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.14.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-61422](https://www.cve.org/CVERecord?id=CVE-2026-61422):
Authenticated pre-validation SSRF in registerTemplate
+
+Authenticated pre-validation SSRF vulnerability in Apache CloudStack's
+template and ISO registration functionality.
+
+When registering a template or ISO, CloudStack makes a live HTTP
+HEAD/GET call to determine file size for secondary storage usage-limit
+checks, and this happens before URL validation is performed. However,
+this does not pose a malicious template or ISO registration risk, as
+URL validation still occurs prior to the actual download by the
+Secondary Storage VM.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Yuliang Xiao <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-62440](https://www.cve.org/CVERecord?id=CVE-2026-62440): Improper
access control in Kubernetes Service (CKS) cluster manipulation
+
+Improper Access Control vulnerability in Apache CloudStack's
+Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of
+the Kubernetes cluster while adding and removing nodes.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - George Chen (GitHub: geo-chen) (reporter)
+ - D0HY30N (GitHub: D0HY30N) (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.22.1.1 or later, which
+addresses these issues.
+
+
+
+## [CVE-2026-65613](https://www.cve.org/CVERecord?id=CVE-2026-65613): Webhook
Deliveries Incorrect Access
+
+Exposure of Sensitive Information to an Unauthorized Actor
+vulnerability in Apache CloudStack's Webhook module while listing and
+deleting deliveries.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.20.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-66721](https://www.cve.org/CVERecord?id=CVE-2026-66721):
Authorization issue with listHostTags for domain admins
+
+Missing authorization issue for domain admins in CloudStack's host
+tags listing functionality.
+
+Domain Admins, by default, have permission to call the listHostTags
+API, but the API returns host tags for every host in the environment
+without domain scoping. It should instead be restricted to only the
+hosts dedicated to that admin's domain.
+
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - KQ Wu <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.12.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-66722](https://www.cve.org/CVERecord?id=CVE-2026-66722):
ProjectRole & ProjectRolePermission authorization issue
+
+Improper authorization for CRUD operations on Project Roles and
+Project Role permissions for domain admins in CloudStack.
+
+A Domain Admin can create, update, delete, and list project roles and
+project role permissions for projects in any domain, not just their
+own. The check only confirms the caller is a Domain Admin, without
+verifying whether the target project belongs to their domain or
+subdomain. This allows a malicious Domain Admin to tamper with project
+roles and permissions across unrelated domains.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - KQ Wu <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.15.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-66797](https://www.cve.org/CVERecord?id=CVE-2026-66797):
Unauthorised comment creation and disclosure
+
+Improper access control in CloudStack's annotation functionality
+allows unauthorized comment creation and disclosure.
+
+The addAnnotation and listAnnotation APIs perform an ownership check
+when an entity's UUID is specified, but fail to honor its result
+correctly. This lets any authenticated user write annotations to, and
+disclose existing annotations/comments on, an entity they don't own by
+simply supplying its UUID.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Łukasz Bawolski <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.16.0.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
+## [CVE-2026-68745](https://www.cve.org/CVERecord?id=CVE-2026-68745): SAML2
Signature Validation Silently Skipped for Cert-less IdP
+
+Certificate validation failures in SAML authentication in Apache
+CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious
+agent to forge a SAML response to the management server. The agent
+will have to spoof the ip address of the IdP or get an url of its own
+choosing registered in the management server, after which it can allow
+logging on with forged signatures.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Katriel Moses <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.5.2 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+## Downloads and Documentation
+
+The official source code for the 4.20.3.1 and 4.22.1.1 releases can be
downloaded
+from the project downloads page:
+
+https://cloudstack.apache.org/downloads
+
+The 4.22.1.1 release notes can be found at:
+- https://docs.cloudstack.apache.org/en/4.22.1.1/releasenotes/about.html
+
+In addition to the official source code release, individual
+contributors have also made release packages available on the Apache
+CloudStack download page, and available at:
+
+- https://download.cloudstack.org/el/8/
+- https://download.cloudstack.org/el/9/
+- https://download.cloudstack.org/el/10/
+- https://download.cloudstack.org/suse/15/
+- https://download.cloudstack.org/debian/dists/
+- https://download.cloudstack.org/ubuntu/dists/
+- https://www.shapeblue.com/cloudstack-packages/
diff --git a/src/components/Releases/index.tsx
b/src/components/Releases/index.tsx
index f051dc422..b5384cf34 100644
--- a/src/components/Releases/index.tsx
+++ b/src/components/Releases/index.tsx
@@ -1,10 +1,12 @@
import React from "react";
const versions = [
+ '4.22.1.1',
'4.22.1.0',
'4.22.0.1',
'4.22.0.0',
'4.21.0.0',
+ '4.20.3.1',
'4.20.3.0',
'4.20.2.0',
'4.20.1.0',
diff --git a/src/pages/downloads.mdx b/src/pages/downloads.mdx
index aa8433b24..efc8389d6 100644
--- a/src/pages/downloads.mdx
+++ b/src/pages/downloads.mdx
@@ -28,42 +28,42 @@ $ sha512sum --check <release-filename>.sha512
### Source Releases
-Apache CloudStack's most recent release is `4.22.1.0`. This is current
+Apache CloudStack's most recent release is `4.22.1.1`. This is current
CloudStack LTS release.
-<a className="button button--primary button--lg"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.0/apache-cloudstack-4.22.1.0-src.tar.bz2";>Get
the 4.22.1.0 Source</a>
+<a className="button button--primary button--lg"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.1/apache-cloudstack-4.22.1.1-src.tar.bz2";>Get
the 4.22.1.1 Source</a>
<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/KEYS";>KEYS</a>
-<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.0/apache-cloudstack-4.22.1.0-src.tar.bz2.asc";>PGP</a>
-<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.0/apache-cloudstack-4.22.1.0-src.tar.bz2.sha512";>SHA512</a>
+<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.1/apache-cloudstack-4.22.1.1-src.tar.bz2.asc";>PGP</a>
+<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.1.1/apache-cloudstack-4.22.1.1-src.tar.bz2.sha512";>SHA512</a>
<br/><br/>
-Full release notes can be found in the version [4.22.1.0 Release
-Notes](https://docs.cloudstack.apache.org/en/4.22.1.0/releasenotes/) website.
+Full release notes can be found in the version [4.22.1.1 Release
+Notes](https://docs.cloudstack.apache.org/en/4.22.1.1/releasenotes/) website.
Instructions for building from source and installing Apache CloudStack can be
found in the [Installation
-Guide](https://docs.cloudstack.apache.org/en/4.22.1.0/installguide/).
+Guide](https://docs.cloudstack.apache.org/en/4.22.1.1/installguide/).
Instructions for building from source and upgrading from a previous version of
-CloudStack to Apache CloudStack 4.22.1.0 can be found in the upgrade section of
+CloudStack to Apache CloudStack 4.22.1.1 can be found in the upgrade section of
the Release Notes (see above).
-The latest CloudStack LTS maintenance release for version `4.22.x.x` is
`4.22.1.0` as part of the
+The latest CloudStack LTS maintenance release for version `4.20.x.x` is
`4.20.3.1` as part of the
previous LTS release.
-<a className="button button--primary button--lg"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.0.1/apache-cloudstack-4.22.0.1-src.tar.bz2";>Get
the 4.22.0.1 Source</a>
+<a className="button button--primary button--lg"
href="https://dlcdn.apache.org/cloudstack/releases/4.20.3.1/apache-cloudstack-4.20.3.1-src.tar.bz2";>Get
the 4.20.3.1 Source</a>
<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/KEYS";>KEYS</a>
-<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.0.1/apache-cloudstack-4.22.0.1-src.tar.bz2.asc";>PGP</a>
-<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.22.0.1/apache-cloudstack-4.22.0.1-src.tar.bz2.sha512";>SHA512</a>
+<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.20.3.1/apache-cloudstack-4.20.3.1-src.tar.bz2.asc";>PGP</a>
+<a className="button button--secondary button--sm"
href="https://dlcdn.apache.org/cloudstack/releases/4.20.3.1/apache-cloudstack-4.20.3.1-src.tar.bz2.sha512";>SHA512</a>
<br/><br/>
-Full release notes can be found in the version [4.22.0.1 Release
-Notes](https://docs.cloudstack.apache.org/en/4.22.0.1/releasenotes/) website.
+Full release notes can be found in the version [4.20.3.1 Release
+Notes](https://docs.cloudstack.apache.org/en/4.20.3.1/releasenotes/) website.
Instructions for building from source and installing Apache CloudStack can be
found in the [Installation
-Guide](https://docs.cloudstack.apache.org/en/4.22.0.1/installguide/).
+Guide](https://docs.cloudstack.apache.org/en/4.20.3.1/installguide/).
Instructions for building from source and upgrading from a previous version of
-CloudStack to Apache CloudStack 4.22.0.1 can be found in the upgrade section of
+CloudStack to Apache CloudStack 4.20.3.1 can be found in the upgrade section of
the Release Notes (see above).
### Community Packages
