search

kir4h / rvault

Small tool to perform some recursive operations on Hashicorp's Vault KV
MIT License
46 stars 11 forks source link

build(deps): bump github.com/hashicorp/vault from 1.14.1 to 1.14.6 #26

Closed dependabot[bot] closed 6 months ago

dependabot[bot] commented 7 months ago

Bumps github.com/hashicorp/vault from 1.14.1 to 1.14.6.

Release notes

Sourced from github.com/hashicorp/vault's releases.

v1.14.6

1.14.6

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

v1.14.5

1.14.5

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]
  • ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [GH-23747]
  • website/docs: fix inaccuracies with unauthenticated_in_flight_requests_access parameter [GH-23287]

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault's changelog.

1.14.6

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

1.14.5

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]
  • ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [GH-23747]

BUG FIXES:

  • command/server: Fix bug with sigusr2 where pprof files were not closed correctly [GH-23636]

... (truncated)

Commits
  • 5efc0cb backport of commit 7ec3867eea2ad3c405f15f9ab5447618685739cf (#24031)
  • 891eb6f backport of commit b19562db9a8c1b65ea660ed0d51aaf9498a9887d (#24025)
  • d828122 docs: add workaround to known issue loading missing policies from other names...
  • e517967 Docs: Update known issues table logger leak (#24012) (#24013)
  • 96f5e64 Revert "Automatically track subloggers in allLoggers (#22038)" (#24005)
  • 59c189b Add known issue for sublogger memory leak (#23977) (#24008)
  • cde950d backport of commit 9538c6e59b69033b7d0441e6eaf6260c0cbbee6d (#23997)
  • b488b2f backport of commit d93a13a7e3f5c2ef9293e3ef0bc84e8823dfe560 (#23990)
  • b7517d0 replace nytimes/gziphandler with klauspost/compress/gzhttp (#23898) (#23962)
  • 8814a4b backport of commit 750ab337eaa0b049d9cf1535c00e860129e5e9a0 (#23955)
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kir4h/rvault/network/alerts).
dependabot[bot] commented 6 months ago

Superseded by #27.