Starstruk Logo MarkStarstruk

v1.13.7

hashicorp/vaultv1.13.7Sep 12, 2023by hc-github-team-es-release-engineering

AI Summary

Fixes a security regression in transit encryption related to nonces and updates Go to 1.20.8. Introduces a new enterprise feature for Merkle Tree Corruption Detection and improves LDAP login speed.

Key Highlights

  • Security: Fix transit nonce regression in non-convergent modes
  • Enterprise Feature: Merkle Tree Corruption Detection endpoint
  • Bump Go version to 1.20.8
  • Performance: Improved LDAP login speed with concurrency
  • Bug fixes for Azure autoseal hangs and CLI wrapping output

New Features

  • Merkle Tree Corruption Detection

Full Release Notes

## 1.13.7
### September 13, 2023

SECURITY:

* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [[GH-22852](https://github.com/hashicorp/vault/pull/22852)]

CHANGES:

* core: Bump Go version to 1.20.8.
* database/snowflake: Update plugin to v0.7.3 [[GH-22591](https://github.com/hashicorp/vault/pull/22591)]

FEATURES:

* **Merkle Tree Corruption Detection (enterprise)**: Add a new endpoint to check merkle tree corruption.

IMPROVEMENTS:

* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
* kmip (enterprise): reduce latency of KMIP operation handling

BUG FIXES:

* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
* kmip (enterprise): fix date handling error with some re-key operations
* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable