« Changelog History


Vault v1.5.1 Release Notes

  • August 20th, 2020

    🔒 SECURITY:

    • 🛠 When using the IAM AWS Auth Method, under certain circumstances, values Vault uses to validate identities and roles can be manipulated and bypassed. This vulnerability affects Vault and Vault Enterprise 0.7.1 and newer and is fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1 (CVE-2020-16250) (Discovered by Felix Wilhelm of Google Project Zero)
    • 🛠 When using the GCP GCE Auth Method, under certain circumstances, values Vault uses to validate GCE VMs can be manipulated and bypassed. This vulnerability affects Vault and Vault Enterprise 0.8.3 and newer and is fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1 (CVE-2020-16251) (Discovered by Felix Wilhelm of Google Project Zero)
    • 🛠 When using Vault Agent with cert auto-auth and caching enabled, under certain circumstances, clients without permission to access agent's token may retrieve the token without login credentials. This vulnerability affects Vault Agent 1.1.0 and newer and is fixed in 1.5.1 (CVE-2020-17455)

    KNOWN ISSUES:

    • 💻 OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the Vault UI. Enterprise binaries are not affected.
    • AWS IAM logins may return an error depending on the headers sent with the request. For more details and a workaround, see the 1.5.1 Upgrade Guide

    🔄 CHANGES:

    • pki: The tidy operation will now remove revoked certificates if the parameter tidy_revoked_certs is set to true. This will result in certificate entries being immediately removed, as opposed to awaiting until its NotAfter time. Note that this only affects certificates that have been already revoked. [GH-9609]
    • ⚡️ go: Updated Go version to 1.14.7

    👌 IMPROVEMENTS:

    • 👍 auth/jwt: Add support for fetching groups and user information from G Suite during authentication. [GH-9574]
    • 🔌 auth/jwt: Add EdDSA to supported algorithms. [GH-129]
    • secrets/openldap: Add "ad" schema that allows the engine to correctly rotate AD passwords. [GH-9740]
    • pki: Add a allowed_domains_template parameter that enables the use of identity templating within the allowed_domains parameter. [GH-8509]
    • 🔊 secret/azure: Use write-ahead-logs to cleanup any orphaned Service Principals [GH-9773]
    • ⚡️ ui: Wrap TTL option on transit engine export action is updated to a new component. [GH-9632]
    • 💻 ui: Wrap Tool uses newest version of TTL Picker component. [GH-9691]

    🐛 BUG FIXES:

    • secrets/gcp: Ensure that the IAM policy version is appropriately set after a roleset's bindings have changed. [GH-9603]
    • replication (enterprise): Fix status API output incorrectly stating replication is in idle state.
    • replication (enterprise): Use PrimaryClusterAddr if it's been set
    • 🖨 core: Fix panic when printing over-long info fields at startup [GH-9681]
    • 🐎 core: Seal migration using the new minimal-downtime strategy didn't work properly with performance standbys. [GH-9690]
    • 🔧 core: Vault failed to start when there were non-string values in seal configuration [GH-9555]
    • core: Handle a trailing slash in the API address used for enabling replication