Skip to content

chore(deps): update dependency hashicorp/vault to v1.15.2

WALL-E requested to merge renovate/hashicorp-vault-1.x into master

This MR contains the following updates:

Package Update Change
hashicorp/vault patch v1.15.0 -> v1.15.2

⚠ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

hashicorp/vault (hashicorp/vault)

v1.15.2

Compare Source

1.15.2

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • api (enterprise): Enable the sys/license/features from any namespace
  • storage/etcd: etcd should only return keys when calling List() [GH-23872]
  • ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [GH-23700]
  • ui: Update sidebar Secrets engine to title case. [GH-23964]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert MR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]
  • ui: fix broken GUI when accessing from listener with chroot_namespace defined [GH-23942]

v1.15.1

Compare Source

1.15.1

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.21.3.

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • auto-auth/azure: Support setting the authenticate_from_environment variable to "true" and "false" string literals, too. [GH-22996]
  • secrets-sync (enterprise): Added telemetry on number of destinations and associations per type.
  • ui: Adds a warning when whitespace is detected in a key of a KV secret [GH-23702]
  • ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [GH-23747]
  • ui: Surface warning banner if UI has stopped auto-refreshing token [GH-23143]
  • ui: show banner when resultant-acl check fails due to permissions or wrong namespace. [GH-23503]
  • website/docs: fix inaccuracies with unauthenticated_in_flight_requests_access parameter [GH-23287]

BUG FIXES:

  • Seal HA (enterprise/beta): Fix rejection of a seal configuration change from two to one auto seal due to persistence of the previous seal type being "multiseal". [GH-23573]
  • audit: Fix bug reopening 'file' audit devices on SIGHUP. [GH-23598]
  • auth/aws: Fixes a panic that can occur in IAM-based login when a client config does not exist. [GH-23555]
  • command/server: Fix bug with sigusr2 where pprof files were not closed correctly [GH-23636]
  • events: Ignore sending context to give more time for events to send [GH-23500]
  • expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [GH-23282]
  • kmip (enterprise): Improve handling of failures due to storage replication issues.
  • kmip (enterprise): Return a structure in the response for query function Query Server Information.
  • mongo-db: allow non-admin database for root credential rotation [GH-23240]
  • replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
  • replication (enterprise): Fix a missing unlock when changing replication state
  • secrets-sync (enterprise): Fixed issue where we could sync a deleted secret
  • secrets/aws: update credential rotation deadline when static role rotation period is updated [GH-23528]
  • secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [GH-23010]
  • secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [GH-23278]
  • secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
  • secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
  • secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
  • secrets/transit: Do not allow auto rotation on managed_key key types [GH-23723]
  • storage/consul: fix a bug where an active node in a specific sort of network partition could continue to write data to Consul after a new leader is elected potentially causing data loss or corruption for keys with many concurrent writers. For Enterprise clusters this could cause corruption of the merkle trees leading to failure to complete merkle sync without a full re-index. [GH-23013]
  • ui: Assumes version 1 for kv engines when options are null because no version is specified [GH-23585]
  • ui: Decode the connection url for display on the connection details page [GH-23695]
  • ui: Fix AWS secret engine to allow empty policy_document field. [GH-23470]
  • ui: Fix bug where auth items were not listed when within a namespace. [GH-23446]
  • ui: Fix regression that broke the oktaNumberChallenge on the ui. [GH-23565]
  • ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [GH-23331]
  • ui: Fixes issue where you could not share the list view URL from the KV v2 secrets engine. [GH-23620]
  • ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [GH-23516]
  • ui: Fixes issues displaying accurate TLS state in dashboard configuration details [GH-23726]

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited by WALL-E

Merge request reports