1.5.3 August 27th, 2020
BUG FIXES:
* auth/aws: Made header handling for IAM authentication more robust
* secrets/ssh: Fixed a bug with role option for SSH signing algorithm to
allow more than RSA signing
1.5.2.1 August 21st, 2020 Enterprise Only
NOTE:
* Includes correct license in the HSM binary.
1.5.2 August 20th, 2020
NOTE:
* OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the
Vault UI. Enterprise binaries are not affected.
KNOWN ISSUES:
* AWS IAM logins may return an error depending on the headers sent with the
request. For more details and a workaround, see the 1.5.2 Upgrade Guide
* In versions 1.2.6, 1.3.9, 1.4.5, and 1.5.2, enterprise licenses on the
HSM build were not incorporated correctly - enterprise customers should use
1.2.6.1, 1.3.9.1, 1.4.5.1, and 1.5.2.1.
1.5.1 August 20th, 2020
SECURITY:
* When using the IAM AWS Auth Method, under certain circumstances, values
Vault uses to validate identities and roles can be manipulated and
bypassed. This vulnerability affects Vault and Vault Enterprise 0.7.1 and
newer and is fixed in 1.2.5, 1.3.8, 1.4.4, and
1.5.1 (CVE-2020-16250) (Discovered by Felix Wilhelm of Google Project Zero)
* When using the GCP GCE Auth Method, under certain circumstances, values
Vault uses to validate GCE VMs can be manipulated and bypassed. This
vulnerability affects Vault and Vault Enterprise 0.8.3 and newer and is
fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1 (CVE-2020-16251) (Discovered by
Felix Wilhelm of Google Project Zero)
* When using Vault Agent with cert auto-auth and caching enabled, under
certain circumstances, clients without permission to access agent's token
may retrieve the token without login credentials. This vulnerability
affects Vault Agent 1.1.0 and newer and is fixed in 1.5.1 (CVE-2020-17455)
KNOWN ISSUES:
* OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the
Vault UI. Enterprise binaries are not affected.
* AWS IAM logins may return an error depending on the headers sent with the
request. For more details and a workaround, see the 1.5.1 Upgrade Guide
CHANGES:
* pki: The tidy operation will now remove revoked certificates if the
parameter tidy_revoked_certs is set to true. This will result in
certificate entries being immediately removed, as opposed to awaiting until
its NotAfter time. Note that this only affects certificates that have been
already revoked. [GH-9609]
IMPROVEMENTS:
* auth/jwt: Add support for fetching groups and user information from G
Suite during authentication. [GH-9574]
* pki: Add a allowed_domains_template parameter that enables the use of
identity templating within the allowed_domains parameter. [GH-8509]
* secret/azure: Use write-ahead-logs to cleanup any orphaned Service
Principals [GH-9773]
* ui: Wrap TTL option on transit engine export action is updated to a new
component. [GH-9632]
* ui: Wrap Tool uses newest version of TTL Picker component. [GH-9691]
BUG FIXES:
* secrets/gcp: Ensure that the IAM policy version is appropriately set
after a roleset's bindings have changed. [GH-9603]
* replication (enterprise): Fix status API output incorrectly stating
replication is in idle state.
* replication (enterprise): Use PrimaryClusterAddr if it's been set
* core: Fix panic when printing over-long info fields at startup [GH-9681]
* core: Seal migration using the new minimal-downtime strategy didn't work
properly with performance standbys. [GH-9690]
* core: Vault failed to start when there were non-string values in seal
configuration [GH-9555]
4ca907cc42