v1.15.5

1.15.5

January 31, 2024

SECURITY:

• audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [GH-24968] [HCSEC-2024-01]

CHANGES:

• core: Bump Go version to 1.21.5.
• database/snowflake: Update plugin to v0.9.1 [GH-25020]
• secrets/ad: Update plugin to v0.16.2 [GH-25058]
• secrets/openldap: Update plugin to v0.11.3 [GH-25040]

IMPROVEMENTS:

• command/server: display logs on startup immediately if disable-gated-logs flag is set [GH-24280]
• core/activity: Include secret_syncs in activity log responses [GH-24710]
• oidc/provider: Adds code_challenge_methods_supported to OpenID Connect Metadata [GH-24979]
• storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [GH-24010]
• sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
  listener config.
• ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [GH-18513]

BUG FIXES:

• audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [GH-25004]
• audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [GH-24968]
• auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
• core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
• core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to
  support azure workload identities. [GH-24954]
• helper/pkcs7: Fix slice out-of-bounds panic [GH-24891]
• kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
• plugins: fix panic when registering containerized plugin with a custom runtime on a perf standby
• ui: Allows users to dismiss the resultant-acl banner. [GH-25106]
• ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [GH-24339]
• ui: Fixed minor bugs with database secrets engine [GH-24947]
• ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [GH-24697]
• ui: Fixes policy input toolbar scrolling by default [GH-23297]
• ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [GH-24660]
• ui: fix KV v2 details view defaulting to JSON view when secret value includes { [GH-24513]
• ui: fix incorrectly calculated capabilities on PKI issuer endpoints [GH-24686]
• ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [GH-24404]
• ui: fix navigation items shown to user when chroot_namespace configured [GH-24492]

v1.15.4

1.15.4

SECURITY:

• core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. Upgrading is strongly recommended.(see CVE-2023-6337 & HCSEC-2023-34)

CHANGES:

• identity (enterprise): POST requests to the /identity/entity/merge endpoint are now always forwarded from standbys to the active node. [GH-24325]

BUG FIXES:

• agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [GH-24252]
• api: Fix deadlock on calls to sys/leader with a namespace configured on the request. [GH-24256]
• core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [GH-24336]
• ui: Correctly handle directory redirects from pre 1.15.0 Kv v2 list view urls. [GH-24281]
• ui: Fix payload sent when disabling replication [GH-24292]
• ui: When Kv v2 secret is an object, fix so details view defaults to readOnly JSON editor. [GH-24290]

v1.14.8

1.14.8

SECURITY:

• core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. Upgrading is strongly recommended.(see CVE-2023-6337 & HCSEC-2023-34)

CHANGES:

• identity (enterprise): POST requests to the /identity/entity/merge endpoint are now always forwarded from standbys to the active node. [GH-24325]

BUG FIXES:

• agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [GH-24252]
• api: Fix deadlock on calls to sys/leader with a namespace configured on the request. [GH-24256]
• core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [GH-24336]
• ui: Fix payload sent when disabling replication [GH-24292]

v1.13.12

1.13.12

SECURITY:

• core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. Upgrading is strongly recommended.(see CVE-2023-6337 & HCSEC-2023-34)

CHANGES:

• identity (enterprise): POST requests to the /identity/entity/merge endpoint are now always forwarded from standbys to the active node. [GH-24325]

BUG FIXES:

• api: Fix deadlock on calls to sys/leader with a namespace configured on the request. [GH-24256]
• core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [GH-24336]
• ui: Fix payload sent when disabling replication [GH-24292]

v1.15.3

1.15.3

November 30, 2023

CHANGES:

• core: Bump Go version to 1.21.4.

IMPROVEMENTS:

• core (enterprise): Speed up unseal when using namespaces
• core: update sys/seal-status (and CLI vault status) to report the type of
  the seal when unsealed, as well as the type of the recovery seal if an
  auto-seal. [GH-23022]
• secrets/pki: do not check TLS validity on ACME requests redirected to https [GH-22521]
• ui: Sort list view of entities and aliases alphabetically using the item name [GH-24103]
• ui: capabilities-self is always called in the user's root namespace [GH-24168]

BUG FIXES:

• activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
• auth/cert: Handle errors related to expired OCSP server responses [GH-24193]
• core (Enterprise): Treat multiple disabled HA seals as a migration to Shamir.
• core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request. [GH-24238]
• core/config: Use correct HCL config value when configuring log_requests_level. [GH-24059]
• core/quotas: Close rate-limit blocked client purge goroutines when sealing [GH-24108]
• core: Fix an error that resulted in the wrong seal type being returned by sys/seal-status while
  Vault is in seal migration mode. [GH-24165]
• replication (enterprise): disallow configuring paths filter for a mount path that does not exist
• secrets-sync (enterprise): Fix panic when setting usage_gauge_period to none
• secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [GH-24192]
• secrets/transit: Fix a panic when attempting to export a public RSA key [GH-24054]
• ui: Fix JSON editor in KV V2 unable to handle pasted values [GH-24224]
• ui: Fix error when tuning token auth configuration within namespace [GH-24147]
• ui: show error from API when seal fails [GH-23921]

v1.14.7

1.14.7

November 30, 2023

CHANGES:

• core: Bump Go version to 1.20.11.

IMPROVEMENTS:

• core (enterprise): Speed up unseal when using namespaces
• secrets/pki: do not check TLS validity on ACME requests redirected to https [GH-22521]
• ui: Sort list view of entities and aliases alphabetically using the item name [GH-24103]
• ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [GH-23700]

BUG FIXES:

• activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
• auth/cert: Handle errors related to expired OCSP server responses [GH-24193]
• core/config: Use correct HCL config value when configuring log_requests_level. [GH-24058]
• core/quotas: Close rate-limit blocked client purge goroutines when sealing [GH-24108]
• replication (enterprise): disallow configuring paths filter for a mount path that does not exist
• secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [GH-24192]
• secrets/transit: Fix a panic when attempting to export a public RSA key [GH-24054]
• ui: Fix error when tuning token auth configuration within namespace [GH-24147]

v1.13.11

1.13.11

November 30, 2023

CHANGES:

• core: Bump Go version to 1.20.11.

IMPROVEMENTS:

• core (enterprise): Speed up unseal when using namespaces
• ui: Sort list view of entities and aliases alphabetically using the item name [GH-24103]

BUG FIXES:

• activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
• auth/cert: Handle errors related to expired OCSP server responses [GH-24193]
• core/config: Use correct HCL config value when configuring log_requests_level. [GH-24057]
• core/quotas: Close rate-limit blocked client purge goroutines when sealing [GH-24108]
• replication (enterprise): disallow configuring paths filter for a mount path that does not exist
• secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [GH-24192]
• ui: Fix error when tuning token auth configuration within namespace [GH-24147]

v1.15.2

1.15.2

November 09, 2023

SECURITY:

• core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

• cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

• api (enterprise): Enable the sys/license/features from any namespace
• storage/etcd: etcd should only return keys when calling List() [GH-23872]
• ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [GH-23700]
• ui: Update sidebar Secrets engine to title case. [GH-23964]

BUG FIXES:

• api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
  on the request. [GH-23861]
• core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
• core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
• core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
• core: Revert PR causing memory consumption bug [GH-23986]
• core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
• core: fix bug where deadlock detection was always on for expiration and quotas.
  These can now be configured individually with detect_deadlocks. [GH-23902]
• core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
• expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]
• ui: fix broken GUI when accessing from listener with chroot_namespace defined [GH-23942]

v1.14.6

1.14.6

November 09, 2023

SECURITY:

• core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• secrets/mongodbatlas: Update plugin to v0.10.2 [GH-23849]

FEATURES:

• cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

• storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

• api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
  on the request. [GH-23861]
• core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
• core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
• core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
• core: Revert PR causing memory consumption bug [GH-23986]
• core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
• core: fix bug where deadlock detection was always on for expiration and quotas.
  These can now be configured individually with detect_deadlocks. [GH-23902]
• core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
• expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]

v1.13.10

1.13.10

November 09, 2023

SECURITY:

• core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [HSEC-2023-33]

CHANGES:

• auth/approle: Normalized error response messages when invalid credentials are provided [GH-23786]
• secrets/mongodbatlas: Update plugin to v0.9.2 [GH-23849]

FEATURES:

• cli/snapshot: Add CLI tool to inspect Vault snapshots [GH-23457]

IMPROVEMENTS:

• storage/etcd: etcd should only return keys when calling List() [GH-23872]

BUG FIXES:

• api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
  on the request. [GH-23861]
• core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
• core/activity: Fixes segments fragment loss due to exceeding entry record size limit [GH-23781]
• core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [GH-23802]
• core: Revert PR causing memory consumption bug [GH-23986]
• core: Skip unnecessary deriving of policies during Login MFA Check. [GH-23894]
• core: fix bug where deadlock detection was always on for expiration and quotas.
  These can now be configured individually with detect_deadlocks. [GH-23902]
• core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [GH-23874]
• expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [GH-24027]