search

jfrog / vault-plugin-secrets-artifactory

HashiCorp Vault Secrets Plugin for Artifactory
https://jfrog.com
Apache License 2.0
39 stars 20 forks source link

build(deps): bump github.com/hashicorp/vault/sdk from 0.10.0 to 0.10.2 #128

Closed dependabot[bot] closed 11 months ago

dependabot[bot] commented 11 months ago

Bumps github.com/hashicorp/vault/sdk from 0.10.0 to 0.10.2.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

0.10.2 (June 6th, 2018)

SECURITY:

  • Tokens: A race condition was identified that could occur if a token's lease expired while Vault was not running. In this case, when Vault came back online, sometimes it would properly revoke the lease but other times it would not, leading to a Vault token that no longer had an expiration and had essentially unlimited lifetime. This race was per-token, not all-or-nothing for all tokens that may have expired during Vault's downtime. We have fixed the behavior and put extra checks in place to help prevent any similar future issues. In addition, the logic we have put in place ensures that such lease-less tokens can no longer be used (unless they are root tokens that never had an expiration to begin with).
  • Convergent Encryption: The version 2 algorithm used in transit's convergent encryption feature is susceptible to offline plaintext-confirmation attacks. As a result, we are introducing a version 3 algorithm that mitigates this. If you are currently using convergent encryption, we recommend upgrading, rotating your encryption key (the new key version will use the new algorithm), and rewrapping your data (the rewrap endpoint can be used to allow a relatively non-privileged user to perform the rewrapping while never divulging the plaintext).
  • AppRole case-sensitive role name secret-id leaking: When using a mixed-case role name via AppRole, deleting a secret-id via accessor or other operations could end up leaving the secret-id behind and valid but without an accessor. This has now been fixed, and we have put checks in place to prevent these secret-ids from being used.

DEPRECATIONS/CHANGES:

  • PKI duration return types: The PKI backend now returns durations (e.g. when reading a role) as an integer number of seconds instead of a Go-style string, in line with how the rest of Vault's API returns durations.

FEATURES:

  • Active Directory Secrets Engine: A new ad secrets engine has been created which allows Vault to rotate and provide credentials for configured AD accounts.
  • Rekey Verification: Rekey operations can now require verification. This turns on a two-phase process where the existing key shares authorize generating a new master key, and a threshold of the new, returned key shares must be provided to verify that they have been successfully received in order for the actual master key to be rotated.
  • CIDR restrictions for cert, userpass, and kubernetes auth methods: You can now limit authentication to specific CIDRs; these will also be encoded in resultant tokens to limit their use.
  • Vault UI Browser CLI: The UI now supports usage of read/write/list/delete commands in a CLI that can be accessed from the nav bar. Complex inputs such as JSON files are not currently supported. This surfaces features otherwise

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)