v1.13.12

hashicorp/vaultv1.13.12Dec 5, 2023by hc-github-team-es-release-engineering

AI Summary

Identical to v1.14.8, addressing the critical DoS vulnerability and specific deadlock fixes. Ensures stability for users running the 1.13.x branch.

Key Highlights

Security fix: Fixes DoS vulnerability via memory exhaustion from large HTTP requests
Fixed deadlock on calls to sys/leader with a namespace configured
UI: Fix payload sent when disabling replication

Full Release Notes

## 1.13.12

SECURITY:

* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. Upgrading is strongly recommended.(see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))

CHANGES:

* identity (enterprise): POST requests to the /identity/entity/merge endpoint are now always forwarded from standbys to the active node. [[GH-24325]](https://github.com/hashicorp/vault/pull/24325)

BUG FIXES:

* api: Fix deadlock on calls to sys/leader with a namespace configured on the request. [[GH-24256]](https://github.com/hashicorp/vault/pull/24256)
* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336]](https://github.com/hashicorp/vault/pull/24336)
* ui: Fix payload sent when disabling replication [[GH-24292]](https://github.com/hashicorp/vault/pull/24292)