Release v1.19.0+suite.1

[gl-johnson]

Release Notes

All notable changes to this project will be documented in this file.

[v1.19.0+suite.1] - 2022-11-30

Table of Contents

• Components
• Installation Instructions for the Suite Release Version of Conjur
• Upgrade Instructions
• Changes

Components

These are the components that combine to create this Conjur OSS Suite release and links to their releases:

Conjur Server

• cyberark/conjur v1.19.0 (2022-11-29)
• cyberark/conjur-openapi-spec v5.3.0 (2021-12-22)
• cyberark/conjur-oss-helm-chart v2.0.5 (2022-08-17)

Conjur SDK

• cyberark/conjur-cli v6.2.8 (2022-08-16)
• cyberark/conjur-api-dotnet v2.1.1 (2022-03-14)
• cyberark/conjur-api-go v0.10.2 (2022-11-14)
• cyberark/conjur-api-java v3.0.3 (2022-05-31)
• cyberark/conjur-api-python3 v7.1.0 (2021-12-22)
• cyberark/conjur-api-ruby v5.4.0 (2022-08-16)

Platform Integrations

• cyberark/cloudfoundry-conjur-buildpack v2.2.6 (2022-11-23)
• cyberark/conjur-service-broker v1.2.7 (2022-11-27)
• cyberark/conjur-authn-k8s-client v0.24.0 (2022-11-23)
• cyberark/secrets-provider-for-k8s v1.4.5 (2022-09-26)

DevOps Tools

• cyberark/ansible-conjur-collection v1.2.0 (2020-09-01)
• cyberark/ansible-conjur-host-identity v0.3.2 (2020-12-29)
• cyberark/conjur-puppet v3.1.0 (2020-10-08)
• cyberark/terraform-provider-conjur v0.6.4 (2022-11-14)

Secretless Broker

• cyberark/secretless-broker v1.7.14 (2022-08-17)

Summon

• cyberark/summon v0.9.5 (2022-09-28)
• cyberark/summon-conjur v0.6.4 (2022-07-06)

Installation Instructions for the Suite Release Version of Conjur

Installing the Suite Release Version of Conjur requires setting the container image tag. Below are more specific instructions depending on environment.

• Docker or docker-compose

  Set the container image tag to cyberark/conjur:1.19.0. For example, make the following update to the conjur service in the quickstart docker-compose.yml

  image: cyberark/conjur:1.19.0

• Conjur Open Source Helm chart

  Update the image.tag value and use the appropriate release of the helm chart:

  helm install ... \
  --set image.tag="1.19.0" \
  ...
  https://github.com/cyberark/conjur-oss-helm-chart/releases/download/v2.0.5/conjur-oss-2.0.5.tgz

Upgrade Instructions

Upgrade instructions are available for the following components:

• cyberark/conjur
• cyberark/conjur-oss-helm-chart

Changes

The following are changes to the constituent components since the last Conjur OSS Suite release:

• cyberark/conjur
• cyberark/conjur-api-go
• cyberark/cloudfoundry-conjur-buildpack
• cyberark/conjur-service-broker
• cyberark/conjur-authn-k8s-client
• cyberark/secrets-provider-for-k8s
• cyberark/terraform-provider-conjur
• cyberark/summon

cyberark/conjur

v1.19.0 (2022-11-29)

• Added
  • Conjur policy loads can now emit callbacks to extensions on policy load lifecycle events (e.g. before/after policy load). This is disabled by default, but is available under the CONJUR_FEATURE_POLICY_LOAD_EXTENSIONS feature flag. cyberark/conjur#2671
  • Conjur roles API can now emit callbacks to extensions on member add and remove events (e.g. before/after add member). This is disabled by default, but is available under the CONJUR_FEATURE_ROLES_API_EXTENSIONS feature flag. cyberark/conjur#2671
• Security
  • Updated nokogiri in root and docs Gemfile.lock files to resolve GHSA-2qc6-mcvw-92cw cyberark/conjur#2670

cyberark/conjur-api-go

v0.10.2 (2022-11-14)

• Fixed
  • Fixed bug with CONJUR_AUTHN_JWT_HOST_ID environment variable not being read cyberark/conjur-api-go#136

cyberark/cloudfoundry-conjur-buildpack

v2.2.6 (2022-11-23)

• Changed
  • Added replace statement to prune gopkg.in/yaml.v2 v2.2.2 in favor of v2.2.8 cyberark/cloudfoundry-conjur-buildpack#153
  • Added replace statement to prune gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c from dependency tree in favor of v3.0.1 cyberark/cloudfoundry-conjur-buildpack#152
• Security
  • Updated Summon, golang.org/x/net, and golang.org/x/text dependencies cyberark/cloudfoundry-conjur-buildpack#156
  • Updated tests/integration/apps/java to use Spring Framework 2.7.5 cyberark/cloudfoundry-conjur-buildpack#155

cyberark/conjur-service-broker

v1.2.7 (2022-11-27)

• Security
  • Upgrade nokogiri to v1.3.9 to resolve GHSA-2qc6-mcvw-92cw cyberark/conjur-service-broker#296
  • Upgrade cucumber (2.99.0 -> 7.1.0) and aruba (1.1.2 -> 2.0.0) to resolve medium severity security issue on Snyk cyberark/conjur-service-broker#294

cyberark/conjur-authn-k8s-client

v0.24.0 (2022-11-23)

• Changed
  • Add service account secret to Conjur Config Cluster Prep chart cyberark/conjur-authn-k8s-client#486

cyberark/secrets-provider-for-k8s

v1.4.5 (2022-09-26)

• Changed
  • Updated Go to 1.19 cyberark/secrets-provider-for-k8s#484
  • Updated go.opentelmetry.io/otel to 1.10.0 and k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go to latest versions cyberark/secrets-provider-for-k8s#484
• Security
  • More replace statements for golang.org/x/crypto, gopkg.in/yaml.v2, and golang.org/x/net cyberark/secrets-provider-for-k8s#486
  • Updated replace statements in go.mod to remove vulnerable versions of golang.org/x/net cyberark/secrets-provider-for-k8s#484 cyberark/secrets-provider-for-k8s#485
  • Updated replace statements in go.mod to remove vulnerable versions of golang.org/x/text cyberark/secrets-provider-for-k8s#484

cyberark/terraform-provider-conjur

v0.6.4 (2022-11-14)

• Security
  • Added replaces for 2 versions of golang.org/x/crypto brought in by the terraform sdk to resolve CVE-2021-43565 cyberark/terraform-provider-conjur#111
  • Upgraded to Go 1.19 cyberark/terraform-provider-conjur#110
  • Forced golang.org/x/net to use v0.0.0-20220923203811-8be639271d50 to resolve CVE-2022-27664 cyberark/terraform-provider-conjur#109

cyberark/summon

v0.9.5 (2022-09-28)

• Changed
  • Upgraded example Dockerfile to use python:3.11 cyberark/summon#243
  • Upgrade Go to 1.19 cyberark/summon#240
• Security
  • Force golang.org/x/text to use v0.3.8 cyberark/summon#241
  • Update aruba (0.6.2 -> 2.0.0), cucumber (2.0.0 -> 7.1.0) and other necessary dependencies in acceptance/Gemfile.lock cyberark/summon#239
  • Update golang.org/x/net to v0.0.0-20220923203811-8be639271d50 cyberark/summon#240

[jtuttle]

What's New

This suite release aligned with Conjur Server version 1.19.0. It includes several minor security and usability fixed to Conjur and its surrounding projects.