Release v1.19.3+suite.1

[john-odonnell]

Desired Outcome

Release v1.19.3+suite.1

Implemented Changes

Updated suite.yml and CHANGELOG.md

Connected Issue/Story

CNJR-1095

Definition of Done

At least 1 todo must be completed in the sections below for the PR to be merged.

Changelog

• [x] The CHANGELOG has been updated, or
• [ ] This PR does not include user-facing changes and doesn't require a CHANGELOG update

Test coverage

• [ ] This PR includes new unit and integration tests to go with the code changes, or
• [x] The changes in this PR do not require tests

Documentation

• [ ] Docs (e.g. READMEs) were updated in this PR
• [x] A follow-up issue to update official docs has been filed here: CNJR-1094
• [ ] This PR does not require updating any documentation

Behavior

• [ ] This PR changes product behavior and has been reviewed by a PO, or
• [ ] These changes are part of a larger initiative that will be reviewed later, or
• [x] No behavior was changed with this PR

Security

• [ ] Security architect has reviewed the changes in this PR,
• [ ] These changes are part of a larger initiative with a separate security review, or
• [x] There are no security aspects to these changes

[john-odonnell]

Release Notes

All notable changes to this project will be documented in this file.

[1.19.3+suite.1] - 2023-04-21

Table of Contents

• Components
• Installation Instructions for the Suite Release Version of Conjur
• Upgrade Instructions
• Changes

Components

These are the components that combine to create this Conjur OSS Suite release and links to their releases:

Conjur Server

• cyberark/conjur v1.19.3 (2023-04-17)
• cyberark/conjur-openapi-spec v5.3.0 (2021-12-22)
• cyberark/conjur-oss-helm-chart v2.0.6 (2023-03-09)

Conjur SDK

• cyberark/conjur-cli-go v8.0.9 (2023-04-21)
• cyberark/conjur-api-dotnet v2.1.1 (2022-03-14)
• cyberark/conjur-api-go v0.11.0 (2023-02-28)
• cyberark/conjur-api-java v3.0.4 (2023-02-27)
• cyberark/conjur-api-python v0.1.0 (2023-02-14)
• cyberark/conjur-api-ruby v5.4.0 (2022-08-16)

Platform Integrations

• cyberark/cloudfoundry-conjur-buildpack v2.2.7 (2023-03-02)
• cyberark/conjur-service-broker v1.2.9 (2023-04-10)
• cyberark/conjur-authn-k8s-client v0.25.0 (2023-03-17)
• cyberark/secrets-provider-for-k8s v1.5.0 (2023-04-12)

DevOps Tools

• cyberark/ansible-conjur-collection v1.2.0 (2020-09-01)
• cyberark/ansible-conjur-host-identity v0.3.2 (2020-12-29)
• cyberark/conjur-puppet v3.1.0 (2020-10-08)
• cyberark/terraform-provider-conjur v0.6.5 (2022-11-30)

Secretless Broker

• cyberark/secretless-broker v1.7.17 (2023-04-17)

Summon

• cyberark/summon v0.9.5 (2022-09-28)
• cyberark/summon-conjur v0.7.0 (2023-03-10)

Installation Instructions for the Suite Release Version of Conjur

Installing the Suite Release Version of Conjur requires setting the container image tag. Below are more specific instructions depending on environment.

• Docker or docker-compose

  Set the container image tag to cyberark/conjur:1.19.3. For example, make the following update to the conjur service in the quickstart docker-compose.yml

  image: cyberark/conjur:1.19.3

• Conjur Open Source Helm chart

  Update the image.tag value and use the appropriate release of the helm chart:

  helm install ... \
  --set image.tag="1.19.3" \
  ...
  https://github.com/cyberark/conjur-oss-helm-chart/releases/download/v2.0.6/conjur-oss-2.0.6.tgz

Upgrade Instructions

Upgrade instructions are available for the following components:

• cyberark/conjur
• cyberark/conjur-oss-helm-chart

Changes

The following are changes to the constituent components since the last Conjur OSS Suite release:

• cyberark/conjur
• cyberark/conjur-oss-helm-chart
• cyberark/conjur-cli-go
• cyberark/conjur-service-broker
• cyberark/conjur-authn-k8s-client
• cyberark/secrets-provider-for-k8s
• cyberark/secretless-broker
• cyberark/summon-conjur

cyberark/conjur

v1.19.3 (2023-04-17)

• Added
  • Conjur now logs when it detects that the Conjur configuration file (conjur.yml) or directory permissions prevent the Conjur server from successfully reading it. Conjur also now logs at the DEBUG level when it detects that either the directory or file do not exist. cyberark/conjur#2715
  • Account admin roles now have a corresponding resource. This ensures that access controls work as expected for this role to access itself. cyberark/conjur#2757
• Changed
  • Removes support for disabling the CONJUR_FEATURE_PKCE_SUPPORT_ENABLED flag. cyberark/conjur#2713
  • Routes on the /roles/ API endpoints now correctly verify the existing of a Role and return 404 when it doesn't exist or the caller has insufficient privilege. cyberark/conjur#2755
• Fixed
  • Fixed a thread-safety bug in secret retrieval when multiple threads attempt to decrypt a secret value with Slosilo/OpenSSL. cyberark/slosilo#31 cyberark/conjur#2718
  • Incomplete HTTP proxy support in the Kubernetes Authenticator is fixed. This allows for an HTTP proxy between Conjur and the Kubernetes API. cyberark/conjur#2766
• Security
  • Updated github-pages version in docs/Gemfile to allow upgrading activesupport to v7.0.4.2 to resolve CVE-2022-22796 cyberark/conjur#2729
  • Upgraded rack to v2.2.6.3 to resolve CVE-2023-27530 cyberark/conjur#2739
  • Upgraded rack to v2.2.6.4 to resolve CVE-2023-27539 cyberark/conjur#2750
  • Updated nokogiri to 1.14.3 for CVE-2023-29469 and CVE-2023-28484 and rails to 6.1.7.3 for CVE-2023-28120 in Gemfile.lock, nokogiri to 1.1.4.3 for CVE-2023-29469 and commonmarker to 0.23.9 for CVE-2023-24824 and CVE-2023-26485 in docs/Gemfile.lock (all Medium severity issues flagged by Dependabot) cyberark/conjur#2776

cyberark/conjur-oss-helm-chart

v2.0.6 (2023-03-09)

• Changed
  • Updated notices to use Conjur CLI v8.0. cyberark/conjur-oss-helm-chart#179

cyberark/conjur-cli-go

v8.0.5 (2023-03-24)

• Changed
  • OIDC login now supports a custom redirect URL port cyberark/conjur-cli-go#117
• Fixed
  • Reject OIDC login if configured port is in use cyberark/conjur-cli-go#117

    v8.0.6 (2023-04-17)

• Fixed
  • Improved error message when using self-signed certificates cyberark/conjur-cli-go#119
  • Fix double prompt in Windows cyberark/conjur-cli-go#120

    v8.0.7 (2023-04-18)

• Fixed
  • Fixed not using hosts file on Windows cyberark/conjur-cli-go#121

    v8.0.8 (2023-04-19)

• Fixed
  • Fixed piping input to conjur init confirmation prompts cyberark/conjur-cli-go#127
  • Made command help text more consistent cyberark/conjur-cli-go#123

    v8.0.9 (2023-04-21)

• Security
  • Redact credentials dumped to logs with --debug flag cyberark/conjur-cli-go#130

cyberark/conjur-service-broker

v1.2.9 (2023-04-10)

• Security
  • Update rack in Gemfile.lock and tests/integration/test-app/Gemfile.lock to 2.2.6.4 to address CVE-2023-27539, and activesupport in Gemfile.lock and tests/integration/test-app/Gemfile.lock to 6.1.7.3 for CVE-2023-28120 (not vulnerable) cyberark/conjur-service-broker#323
  • Update rack in Gemfile.lock and tests/integration/test-app/Gemfile.lock to 2.2.6.3 for CVE-2023-27630 (not vulnerable) cyberark/conjur-service-broker#320

cyberark/conjur-authn-k8s-client

v0.25.0 (2023-03-17)

• Changed
  • Upgrade ruby from 2.4 to 3.1 in bin/test-workflow/test_app_summon/Dockerfile cyberark/conjur-authn-k8s-client#508
  • Upgrade base image in Dockerfiles to 1.19 and necessary dependencies cyberark/conjur-authn-k8s-client#502
  • Add a wait for the master before provisioning the follower in the CI tests. cyberark/conjur-authn-k8s-client#499
  • The version from the automated release should be used in the start up logs cyberark/conjur-authn-k8s-client#503
  • Update the docs for service account secret cyberark/conjur-authn-k8s-client#509
• Removed
  • Removed support for Conjur v4 and the CONJUR_VERSION env variable cyberark/conjur-authn-k8s-client#505

cyberark/secrets-provider-for-k8s

v1.4.6 (2023-01-26)

• Security
  • Updated replace statements in go.mod to remove vulnerable versions of golang.org/x/net cyberark/secrets-provider-for-k8s#496

    v1.5.0 (2023-04-12)

• Added
  • Convert cmd/secrets-provider to unit testable entrypoint package. cyberark/secrets-provider-for-k8s#507
  • Adds support for binary secret values and values with special characters. cyberark/secrets-provider-for-k8s#500
  • Adds support for content-type annotation and base64 secrets decoding feature. cyberark/secrets-provider-for-k8s#508 cyberark/secrets-provider-for-k8s#511 cyberark/secrets-provider-for-k8s#513 cyberark/secrets-provider-for-k8s#512 cyberark/secrets-provider-for-k8s#509 cyberark/secrets-provider-for-k8s#504 cyberark/secrets-provider-for-k8s#506
  • Use Conjur CLI v8.0. cyberark/secrets-provider-for-k8s#505
  • Add ImagePullSecret to Helm deployment. cyberark/secrets-provider-for-k8s#503

cyberark/secretless-broker

v1.7.16 (2022-12-27)

• Security
  • Updated direct dependencies in bin/juxtaposer/go.mod and go.mod and add replace statements for known vulnerable third-party versions. cyberark/secretless-broker#1479]
  • Upgrade golang.org/x/text and golange.org/x/net to reolve CVE-2022-32149 and CVE-2022-27664 cyberark/secretless-broker#1478
  • Upgrade website Dockerfiles to Ruby 3 to resolve CVE-2022-0778. cyberark/secretless-broker#1475
  • Update go-mssqldb submodule to resolve CVE-2022-41717 and CVE-2022-41721 cyberark/secretless-broker#1483

    v1.7.17 (2023-04-17)

• Changed
  • Updated Go version to 1.19 cyberark/secretless-broker#1491
• Security
  • Updated github.com/aws/aws-sdk-go to v1.44.0 to remove security issues cyberark/secretless-broker#1490
  • Updated golang.org/x/net to v0.7.0 to remove CVE-2022-41723 cyberark/secretless-broker#1488

cyberark/summon-conjur

v0.7.0 (2023-03-10)

• Added
  • Added support for Conjur's OIDC and LDAP authenticators cyberark/summon-conjur#108
• Changed
  • Updated Golang to 1.19 cyberark/summon-conjur#108
• Removed
  • Removed support for Conjur v4 cyberark/summon-conjur#108
• Security
  • Update golang.org/x/sys to v0.1.0 for CVE-2022-29526 (not vulnerable) cyberark/summon-conjur#110

[jtuttle]

What's New

This suite release aligned with Conjur Server version 1.19.3.

Secrets Provider for K8s base64 Encoding

The Secrets Provider for K8s can now be configured using the content-type annotation to automatically decode base64-encoded secrets retrieved from Conjur.

Bug Fixes and Security Patches

Conjur and several other projects in the OSS Suite have been updated with bug fixes and security patches. See the release notes for details.