search

ecadlabs / signatory

Signatory - A Tezos Remote Signer for signing block-chain operations with private keys using YubiHSM, AWS, GCP, Ledger's or Azure Key Vault
https://signatory.io
Apache License 2.0
61 stars 18 forks source link

Bump github.com/hashicorp/vault/api/auth/approle from 0.4.1 to 0.5.0 #457

Closed dependabot[bot] closed 11 months ago

dependabot[bot] commented 11 months ago

Bumps github.com/hashicorp/vault/api/auth/approle from 0.4.1 to 0.5.0.

Changelog

Sourced from github.com/hashicorp/vault/api/auth/approle's changelog.

0.5.0 (February 10, 2016)

SECURITY:

  • Previous versions of Vault could allow a malicious user to hijack the rekey operation by canceling an operation in progress and starting a new one. The practical application of this is very small. If the user was an unseal key owner, they could attempt to do this in order to either receive unencrypted reseal keys or to replace the PGP keys used for encryption with ones under their control. However, since this would invalidate any rekey progress, they would need other unseal key holders to resubmit, which would be rather suspicious during this manual operation if they were not also the original initiator of the rekey attempt. If the user was not an unseal key holder, there is no benefit to be gained; the only outcome that could be attempted would be a denial of service against a legitimate rekey operation by sending cancel requests over and over. Thanks to Josh Snyder for the report!

DEPRECATIONS/CHANGES:

  • s3 physical backend: Environment variables are now preferred over configuration values. This makes it behave similar to the rest of Vault, which, in increasing order of preference, uses values from the configuration file, environment variables, and CLI flags. GH-871
  • etcd physical backend: sync functionality is now supported and turned on by default. This can be disabled. GH-921
  • transit: If a client attempts to encrypt a value with a key that does not yet exist, what happens now depends on the capabilities set in the client's ACL policies. If the client has create (or create and update) capability, the key will upsert as in the past. If the client has update capability, they will receive an error. GH-1012
  • token-renew CLI command: If the token given for renewal is the same as the client token, the renew-self endpoint will be used in the API. Given that the default policy (by default) allows all clients access to the renew-self endpoint, this makes it much more likely that the intended operation will be successful. GH-894
  • Token lookup: the ttl value in the response now reflects the actual remaining TTL rather than the original TTL specified when the token was created; this value is now located in creation_ttl GH-986
  • Vault no longer uses grace periods on leases or token TTLs. Uncertainty about the length grace period for any given backend could cause confusion and uncertainty. GH-1002
  • rekey: Rekey now requires a nonce to be supplied with key shares. This nonce is generated at the start of a rekey attempt and is unique for that attempt.
  • status: The exit code for the status CLI command is now 2 for an uninitialized Vault instead of 1. 1 is returned for errors. This better matches the rest of the CLI.

FEATURES:

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
cloudflare-pages[bot] commented 11 months ago

Deploying with  Cloudflare Pages  Cloudflare Pages

Latest commit: d5635dd
Status: ✅  Deploy successful!
Preview URL: https://4dd6a010.signatory.pages.dev
Branch Preview URL: https://dependabot-go-modules-github-mg47.signatory.pages.dev

View logs

dependabot[bot] commented 11 months ago

Looks like github.com/hashicorp/vault/api/auth/approle is up-to-date now, so this is no longer needed.