search

madrisan / hashicorp-vault-monitor

:key: HashiCorp Vault Monitoring Tool
Mozilla Public License 2.0
24 stars 4 forks source link

Bump github.com/hashicorp/vault from 1.13.5 to 1.13.10 #30

Closed dependabot[bot] closed 9 months ago

dependabot[bot] commented 10 months ago

Bumps github.com/hashicorp/vault from 1.13.5 to 1.13.10.

Release notes

Sourced from github.com/hashicorp/vault's releases.

v1.13.10

1.13.10

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.9.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

v1.13.9

1.13.9

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]

BUG FIXES:

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault's changelog.

1.13.10

November 09, 2023

SECURITY:

  • core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

  • auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
  • secrets/mongodbatlas: Update plugin to v0.9.2 [GH-23849]

FEATURES:

  • cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

  • storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

  • api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [GH-23861]
  • core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
  • core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
  • core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
  • core: Revert PR causing memory consumption bug [GH-23986]
  • core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
  • core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with detect_deadlocks. [GH-23902]
  • core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
  • expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

1.13.9

October 25, 2023

CHANGES:

  • core: Bump Go version to 1.20.10.
  • replication (enterprise): Switch to non-deprecated gRPC field for resolver target host

IMPROVEMENTS:

  • api/plugins: add tls-server-name arg for plugin registration [GH-23549]
  • core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [GH-22567]

BUG FIXES:

  • command/server: Fix bug with sigusr2 where pprof files were not closed correctly [GH-23636]
  • events: Ignore sending context to give more time for events to send [GH-23500]

... (truncated)

Commits
  • 3968035 backport of commit 7ec3867eea2ad3c405f15f9ab5447618685739cf (#24030)
  • e273d02 backport of commit b19562db9a8c1b65ea660ed0d51aaf9498a9887d (#24024)
  • ac3bfb4 docs: add workaround to known issue loading missing policies from other names...
  • e8ebe6b Revert "Automatically track subloggers in allLoggers (#22038)" (#24004)
  • 0b0b730 Add known issue for sublogger memory leak (#23977) (#24007)
  • 535ca5f backport of commit 9538c6e59b69033b7d0441e6eaf6260c0cbbee6d (#23996)
  • 9ec145b backport of commit d93a13a7e3f5c2ef9293e3ef0bc84e8823dfe560 (#23989)
  • fa61a0b replace nytimes/gziphandler with klauspost/compress/gzhttp (#23898) (#23961)
  • 2f510cc backport of commit 750ab337eaa0b049d9cf1535c00e860129e5e9a0 (#23954)
  • 89c37a7 Backport of [DOCS] Link to compliance page for vault instead of a pdf into re...
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/madrisan/hashicorp-vault-monitor/network/alerts).
dependabot[bot] commented 9 months ago

Superseded by #31.