HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.
Affected versions
0 → fixed in 1.13.51.14.0 → fixed in 1.14.1
Details
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
The fix
Release delta 1.14.0 → 1.14.1 (contains the fix)
website/content/docs/configuration/log-requests-level.mdx+24 −9
@@ -9,23 +9,38 @@ description: |-Vault can be configured to log completed requests using the `log_requests_level` configuration parameter.## Activating the Log Completed Requests+## Activating Logging Completed RequestsBy default, logging completed requests is disabled. To activate the requests logging, set the `log_requests_level`+By default, logging completed requests is disabled. To activate request logging, set the `log_requests_level`configuration option in the Vault server configuration to the desired logging level. The acceptable logging levels are-`error`, `warn`, `info`, `debug`, and `trace`.-If the vault server is already running, you can still configure the parameter in the Vault server configuration,-and then send an `SIGHUP` signal to the vault process.+`error`, `warn`, `info`, `debug`, `trace`, and `off`, which is the default.+Completed requests will be logged at the configured level, if Vault's log level includes this level of logs. For+example, if `log_level` is set to `debug`, but `log_requests_level` is set to `trace`, completed requests will+not be logged.+If the Vault server is already running, you can still configure the parameter in the Vault server configuration,+and then send a `SIGHUP` signal to the Vault process.```hcl-log_requests_level = "trace"+log_requests_level = "debug"+log_level = "debug"listener "tcp" {# ...}```## Deactivating the Log Completed Requests+## Deactivating Logging Completed Requests+To deactivate logging completed requests, simply remove the `log_requests_level` configuration parameter+from the Vault server configuration, or set it to `off`, and send a `SIGHUP` signal to the Vault process.+```hcl+log_requests_level = "off"+log_level = "debug"To deactivate logging completed requests, simply remove the `log_requests_level`-configuration parameter from the vault server configuration, and send a `SIGHUP` signal to the vault process.+listener "tcp" {+# ...+}+```<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>d8b811d8da56589ad1de0396d8d09a07c88fdb10 (#21385).../docs/enterprise/license/utilization-reporting.mdx | 9 ++++++---1 file changed, 6 insertions(+), 3 deletions(-)
website/content/docs/auth/jwt/index.mdx+10 −0
@@ -360,6 +360,16 @@ A parameter of `"division"` will reference "North America", as this is a top levJSON Pointer can be used as a selector. Refer to the[JSON Pointer RFC](https://tools.ietf.org/html/rfc6901) for a full description of the syntax.## Tutorial+Refer to the following tutorials for OIDC auth method usage examples:+- [OIDC Auth Method](/vault/tutorials/auth-methods/oidc-auth)+- [Azure Active Directory with OIDC Auth Method and External+Groups](/vault/tutorials/auth-methods/oidc-auth-azure)+- [OIDC Authentication with Okta](/vault/tutorials/auth-methods/vault-oidc-okta)+- [OIDC Authentication with Google Workspace](/vault/tutorials/auth-methods/google-workspace-oauth)+## APIThe JWT Auth Plugin has a full HTTP API. Please see the
website/content/docs/release-notes/1.14.0.mdx+271 −18
@@ -1,31 +1,284 @@---layout: docs-page_title: 1.14.0+page_title: "1.14.0 release notes"description: |--This page contains release notes for Vault 1.14.0+Key updates for Vault 1.14.0---# Vault 1.14.0 Release Notes+# Vault 1.14.0 release notes**Software Release date:** TBD+**GA date:** June 21, 2023**Summary:** Vault Release 1.14.0 offers features and enhancements that improve-the user experience while solving critical issues previously encountered by our-customers. We are providing an overview of improvements in this set of release-notes.+@include 'release-notes/intro.mdx'~> Note: these are **draft** notes for a future version of Vault. They should not be considered-official guidance until the release has been completed.+## Known issues and breaking changes## Known issues+Version | Issue+------- | ------------------------------------------------------------+1.14.0+ | [Users limited by control groups can only access issuer detail from PKI overview page](/vault/docs/upgrading/upgrade-to-1.14.x#ui-pki-control-groups)+All | [API calls to update-primary may lead to data loss](/vault/docs/upgrading/upgrade-to-1.14.x#update-primary-data-loss)@include 'ui-pki-control-groups-known-issue.mdx'+## Vault companion updates@include 'update-primary-known-issue.mdx'+Companion updates are Vault updates that live outside the main Vault binary.## Feature Deprecations and EOL+<table>+<thead>+<tr>+<th style={{verticalAlign: 'middle'}}>Release</th>+<th style={{verticalAlign: 'middle'}}>Update</th>+<th style={{verticalAlign: 'middle'}}>Description</th>+</tr>+</thead>+<tbody>Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page-for up-to-date information on feature deprecations and plans. A [Feature-Deprecation FAQ](/vault/docs/deprecation/faq) page addresses questions about-decisions made about Vault feature deprecations.+<tr>+<td style={{verticalAlign: 'middle'}}>+Vault Secrets Operator for Kubernetes+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Directly connect Vault secrets into Pods as native Kubernetes Secrets+without modifying your application code.+<br /><br />+Learn more: <a href="/vault/docs/platform/k8s/vso">Vault Secrets Operator</a>+</td>+</tr>+<tr>+<td rowspan={2} style={{verticalAlign: 'middle'}}>+Terraform+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Use LDAP authentication from the unified LDAP engine to Terraform Vault+Provider.+<br /><br />+Learn more: <a href="/vault/docs/secrets/ldap">LDAP Secrets Engine</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Support for additional PKI issuers and keys endpoints.+<br /><br />+Learn more: <a href="/vault/docs/secrets/pki">PKI Secrets Engine</a>+</td>+</tr>+</tbody>+</table>+## Core updates+Follow the learn more links for more information, or browse the list of+[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).+<table>+<thead>+<tr>+<th style={{verticalAlign: 'middle'}}>Release</th>+<th style={{verticalAlign: 'middle'}}>Update</th>+<th style={{verticalAlign: 'middle'}}>Description</th>+</tr>+</thead>+<tbody>+<tr>+<td rowspan={2} style={{verticalAlign: 'middle'}}>+Public Key Infrastructure (PKI)+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Use ACME to automate certificate lifecycle management for private PKI+needs with standard ACME clients like Certbot and k8s cert-manager.+Request certificates from a Vault server without needing to know Vault+APIs or authentication mechanisms.+<br /><br />+Learn more: +<a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine API: ACME</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Use the improved PKI web UI to manage your PKI instance with intuitive+configuration and reasonable defaults for workflows, metadata, issuer+info, mount and tidy configuration, cross signing, multi-issuers etc.and+includes.+<br /><br />+Learn more: +<a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle'}}>+Security patches+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Various security improvements to remediate low severity and informational+findings from a 3rd party security audit.+<br /><br />+Learn more: <a href="/vault/docs/internals/security">Vault security model</a>+</td>+</tr>+<tr>+<td rowspan={2} style={{verticalAlign: 'middle'}}>+Vault Agent+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>+<td style={{verticalAlign: 'middle'}}>+Fetch secrets directly into your application as environment variables.+<br /><br />+Learn more: <a href="/vault/docs/agent-and-proxy/agent/process-supervisor">Process Supervisor Mode</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>TEXT</td>+<td style={{verticalAlign: 'middle'}}>+Use a new subcommand and daemon, Vault Proxy, to access the proxy+functionality of Vault Agent. Vault Proxy will handle Vault Agent proxy+functionality going forward to simplify use case decisions for customers.+<br /><br />+Learn more: <a href="/vault/docs/agent-and-proxy/proxy">Vault Proxy</a>+</td>+</tr>+<tr>+<td rowspan={3} style={{verticalAlign: 'middle'}}>+Plugin support+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Capture plugin metadata in the Vault audit log.+<br /><br />+Learn more: <a href="/vault/docs/audit/syslog">Syslog audit device</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Use X509 Authentication and Terraform Vault Provider in the MongoDB Atlas+Database Secrets Engine.+<br /><br />+Learn more: +<a href="/vault/docs/secrets/databases/mongodbatlas">MongoDB Atlas Database Secrets Engine</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Dependency updates and more robust multiplexing for secrets and+authentication plugins.+<br /><br />+Learn more: +<a href="/vault/docs/plugins/plugin-development#serving-a-plugin-with-multiplexing">+Serving a plugin with multiplexing (Plugin Development)+</a>+</td>+</tr>+<tr>+<td rowspan={2} style={{verticalAlign: 'middle'}}>+AWS support+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Monitoring and performance enhancements for the Vault Lambda extension.+<br /><br />+Learn more: +<a href="/vault/docs/platform/aws/lambda-extension">Vault Lambda Extension guide</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Use static roles for IAM users in the AWS Secrets Engine.+<br /><br />+Learn more: <a href="/vault/docs/secrets/aws">AWS Secrets Engine</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle'}}>+Vault GUI+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Streamlined and aligned navigation with HCP Vault UI.+<br /><br />+Learn more: <a href="/vault/docs/configuration/ui">Vault UI</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle'}}>+Transit+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+<b>Contributed by the OSS community</b>. Support for public-key only Transit+keys and BYOK-secured export of key material.+<br /><br />+Learn more: <a href="/vault/api-docs/secret/transit">Transit Secrets Engine</a>+</td>+</tr>+</tbody>+</table>+## Enterprise updates+<table>+<thead>+<tr>+<th style={{verticalAlign: 'middle'}}>Release</th>+<th style={{verticalAlign: 'middle'}}>Update</th>+<th style={{verticalAlign: 'middle'}}>Description</th>+</tr>+</thead>+<tbody>+<tr>+<td style={{verticalAlign: 'middle'}}>+Vault replication+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>+<td style={{verticalAlign: 'middle'}}>+Stability improvements based on customer feedback for Vault 1.13. See the+<a href="https://raw.githubusercontent.com/hashicorp/vault/main/CHANGELOG.md">+Vault changelog+</a>+for a full list of bug fixes.+<br /><br />+Learn more: +<a href="/vault/docs/internals/replication">Replication overview</a>+</td>+</tr>+<tr>+<td style={{verticalAlign: 'middle'}}>+License utilization reporting+</td>+<td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>+<td style={{verticalAlign: 'middle'}}>+Enables automatic license utilization reporting for you and HashiCorp to+ensure transparent, accurate billing.+<br /><br />+Learn more: +<a href="/vault/docs/enterprise/license/utilization-reporting">Automated License utilization reporting</a>+</td>+</tr>+</tbody>+</table>+## Feature deprecations and EOL+Deprecated in 1.14 | Retired in 1.14+------------------ | ---------------+Vault Agent API proxy support | [Duplicative Docker Images](https://hub.docker.com/_/vault)+@include 'release-notes/deprecation-note.mdx'
website/content/docs/auth/index.mdx+7 −4
@@ -50,7 +50,10 @@ automatically logged out.## External Auth Method ConsiderationsWhen using an external auth method (e.g., GitHub), Vault will call the external service-at the time of authentication and for any subsequent token renewals. This means that issued tokens-are valid for their entire duration, and are not invalidated until a renewal or user re-authentication-occurs. Operators should ensure appropriate [token TTLs](/vault/docs/concepts/tokens#the-general-case)-are set when using these auth methods.+at the time of authentication and for subsequent token renewals. If the status+of an entity changes in the external system (e.g., an account expires or is+disabled), Vault denies requests to **renew** tokens associated with the entity.+However, any existing token remain valid for the original grant period unless+they are explicitly revoked within Vault. Operators should set appropriate+[token TTLs](/vault/docs/concepts/tokens#the-general-case) when using external+authN methods.<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>e3dad5b6da871c82d8688467fcc7279f484c24d4 (#21425)website/content/api-docs/libraries.mdx | 6 ++++++1 file changed, 6 insertions(+)
website/content/partials/ui-pki-control-groups-known-issue.mdx+13 −8
@@ -1,12 +1,17 @@-### Control Groups with Issuer detail reads only accessible in UI from overview+### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))Given a scenario where a user can only read an Issuer's details after Control Group-approval, they will constantly be directed to the Control Group Access page when-attempting to link to the Issuer details page from the Issuer list page.+#### Affected versionsAs a workaround, users constrained by Control Groups can select an Issuer to view-details for from the overview page rather than through the Issuers list page.+- Vault 1.14.x#### Impacted Versions+#### IssueAffects all current versions of 1.14.x+Vault UI users who require control group approval to read issuer details are+directed to the Control Group Access page when they try to view issuer details+from links on the Issuer list page.+#### Workaround+Vault UI users constrained by control groups should select issuers from the+**PKI overview** page to view detailed information instead of the+**Issuers list** page.
website/content/docs/enterprise/license/utilization-reporting.mdx+6 −3
@@ -20,7 +20,8 @@ utilization as defined in our contracts. They consist of mostly computed metricsand will never contain Personal Identifiable Information (PII) or othersensitive information. Automated reporting shares the data with HashiCorp usinga secure, unidirectional HTTPS API and makes an auditable record in the product-logs each time it submits a report.+logs each time it submits a report. The reports are submitted once every 24+hours.## Enable automated reporting@@ -42,11 +43,13 @@ addresses:### 2. UpgradeUpgrade to a release that supports entitlement utilization reporting. These+Upgrade to a release that supports license utilization reporting. Thesereleases include:- [Vault Enterprise 1.14.0](https://releases.hashicorp.com/vault/) and later-- [Vault Enterprise 1.13.4](https://releases.hashicorp.com/vault/) and later 1.13.x versions+- [Vault Enterprise 1.12.8](https://releases.hashicorp.com/vault/) and later 1.12.x versions+- [Vault Enterprise 1.11.12](https://releases.hashicorp.com/vault/)### 3. Check logswebsite/content/docs/release-notes/1.14.0.mdx | 289 ++++++++++++++++--.../docs/upgrading/upgrade-to-1.14.x.mdx | 26 +-website/content/partials/alerts/rc-alert.mdx | 7 +.../known-issues/ui-pki-control-groups.mdx | 17 ++.../known-issues/update-primary-data-loss.mdx | 64 ++++.../release-notes/deprecation-note.mdx | 4 +.../content/partials/release-notes/intro.mdx | 8 +.../ui-pki-control-groups-known-issue.mdx | 21 +-.../partials/update-primary-known-issue.mdx | 136 ++++-----website/data/docs-nav-data.json | 6 +-10 files changed, 458 insertions(+), 120 deletions(-)create mode 100644 website/content/partials/alerts/rc-alert.mdxcreate mode 100644 website/content/partials/known-issues/ui-pki-control-groups.mdxcreate mode 100644 website/content/partials/known-issues/update-primary-data-loss.mdxcreate mode 100644 website/content/partials/release-notes/deprecation-note.mdxcreate mode 100644 website/content/partials/release-notes/intro.mdx
website/content/partials/known-issues/ui-pki-control-groups.mdx+17 −0
@@ -0,0 +1,17 @@+### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))+#### Affected versions+- Vault 1.14.x+#### Issue+Vault UI users who require control group approval to read issuer details are+directed to the Control Group Access page when they try to view issuer details+from links on the Issuer list page.+#### Workaround+Vault UI users constrained by control groups should select issuers from the+**PKI overview** page to view detailed information instead of the+**Issuers list** page.
builtin/logical/pki/integration_test.go+6 −0
@@ -237,6 +237,8 @@ func TestIntegration_SetSignedWithBackwardsPemBundles(t *testing.T) {require.False(t, resp.IsError(), "got an error from generating root ca: %#v", resp)rootCert := resp.Data["certificate"].(string)schema.ValidateResponse(t, schema.GetResponseSchema(t, rootBackend.Route("issuers/generate/root/internal"), logical.UpdateOperation), resp, true)+// generate intermediateresp, err = intBackend.HandleRequest(context.Background(), &logical.Request{Operation: logical.UpdateOperation,@@ -298,6 +300,8 @@ func TestIntegration_SetSignedWithBackwardsPemBundles(t *testing.T) {require.NoError(t, err, "failed setting up role example")require.NotNil(t, resp, "got nil response from setting up role example: %#v", resp)schema.ValidateResponse(t, schema.GetResponseSchema(t, intBackend.Route("roles/example"), logical.UpdateOperation), resp, true)+// Issue certresp, err = intBackend.HandleRequest(context.Background(), &logical.Request{Operation: logical.UpdateOperation,@@ -312,6 +316,8 @@ func TestIntegration_SetSignedWithBackwardsPemBundles(t *testing.T) {require.NoError(t, err, "failed issuing a leaf cert from int ca")require.NotNil(t, resp, "got nil response issuing a leaf cert from int ca")require.False(t, resp.IsError(), "got an error issuing a leaf cert from int ca: %#v", resp)+schema.ValidateResponse(t, schema.GetResponseSchema(t, intBackend.Route("issue/example"), logical.UpdateOperation), resp, true)}func TestIntegration_CSRGeneration(t *testing.T) {
website/content/docs/secrets/pki/index.mdx+12 −4
@@ -46,11 +46,19 @@ The PKI Secrets Engine documentation is split into the following pieces:## TutorialRefer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)-guide for a step-by-step tutorial.+Refer to the following tutorials for PKI secrets engine usage examples:+- [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)+- [Build Certificate Authority (CA) in Vault with an offline Root](/vault/tutorials/secrets-management/pki-engine-external-ca)+- [Enable ACME with PKI secrets engine](/vault/tutorials/new-release/pki-acme-caddy)+- [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)+- [PKI Unified CRL and OCSP With Cross Cluster+Revocation](/vault/tutorials/secrets-management/pki-unified-crl-ocsp-cross-cluster)+- [Configure Vault as a Certificate Manager in Kubernetes with+Helm](/vault/tutorials/kubernetes/kubernetes-cert-manager)+- [Generate mTLS Certificates for Nomad using+Vault](/vault/tutorials/secrets-management/vault-pki-nomad)Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)-for more about how to use externally managed keys with PKI.## API<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>8e40823fe1cf40cecb1e004be29fde5fdb875bdb (#21416)website/content/api-docs/secret/cubbyhole.mdx | 2 +-website/content/api-docs/secret/kv/kv-v1.mdx | 16 +++++++++-------website/content/api-docs/secret/kv/kv-v2.mdx | 7 ++++---3 files changed, 14 insertions(+), 11 deletions(-)
website/content/docs/secrets/ldap.mdx+6 −0
@@ -462,6 +462,12 @@ olcPPolicyHashCleartext: TRUEolcPPolicyUseLockout: TRUE```## Tutorial+Refer to the [LDAP Secrets Engine](/vault/tutorials/secrets-management/openldap)+tutorial to learn how to configure and use the LDAP secrets engine.+## APIThe LDAP secrets engine has a full HTTP API. Please see the [LDAP secrets engine API docs](/vault/api-docs/secret/ldap)
website/content/docs/upgrading/index.mdx+40 −0
@@ -82,5 +82,45 @@ tutorial for more details.If you're currently on a version of Vault before 1.11, or you've chosen to opt-out the Autopilot automated upgrade features when running Vault after 1.11 with Integrated Storage, or if you are running Vault with other storage backend such as Consul. Please refer to our [Vault HA upgrades Pre 1.11/Without Autopilot Upgrade Automation](/vault/docs/upgrading/vault-ha-upgrade) documentation for more details. Please note that this upgrade procedure also applies if you are upgrading Vault from pre 1.11 to post 1.11.## Enterprise Replication Installations<Note>Prior to any upgrade, be sure to also read and follow any instructions in the+version-specific upgrade notes which are found in the navigation menu for this+documentation.+</Note>+Upgrading Vault Enterprise clusters which participate in [Enterprise+Replication](/vault/docs/enterprise/replication) requires the following basic+order of operations:+- **Upgrade the replication secondary instances first** using appropriate+guidance from the previous sections+- Verify functionality of each secondary instance after upgrading+- When satisfied with functionality of upgraded secondary instances, upgrade+the primary instance+<Note>+It is not safe to replicate from a newer version of Vault to an older version.+When upgrading replicated clusters, ensure that upstream clusters are always on+older versions of Vault than downstream clusters.+</Note>+Here is an example of upgrading four Vault replicated Vault clusters:++In the above scenario, the ideal upgrade procedure would be as follows,+verifying functionality after each cluster upgrade.+1. Upgrade Clusters B and D. These clusters have no downstream clusters, so they+should be upgraded first, but the ordering of B vs D does not matter.+2. Upgrade Cluster C, which now has an upgraded downstream cluster (Cluster D).+Because Cluster C is a cluster, it should also use the HA upgrade process.+3. Finally, upgrade Cluster A. All clusters downstream of A will already be+upgraded. It should be upgraded last, as it is a Performance Primary and a DR+Primary.
website/content/docs/upgrading/vault-ha-upgrade.mdx+3 −44
@@ -64,14 +64,14 @@ Perform these steps on each standby:At this point all standby nodes are upgraded and ready to take over. Theupgrade will not complete until one of the upgraded standby nodes takes over-active duty.+active duty.To complete the cluster upgrade:1. Properly shut down the remaining (active) node<Note>-It is important that you shut the node down properly.This will perform a step-down and release the HA lock, allowing a standbynode to take over with a very short delay.@@ -97,45 +97,4 @@ upgrade notes.## Enterprise Replication Installations<Note>-Prior to any upgrade, be sure to also read and follow any instructions in the-version-specific upgrade notes which are found in the navigation menu for this-documentation.-</Note>-Upgrading Vault Enterprise clusters which participate in [Enterprise-Replication](/vault/docs/enterprise/replication) requires the following basic-order of operations:-- **Upgrade the replication secondary instances first** using appropriate-guidance from the previous sections depending on whether each secondary-instance is non-HA or HA-- Verify functionality of each secondary instance after upgrading-- When satisfied with functionality of upgraded secondary instances, upgrade-the primary instance-<Note>-It is not safe to replicate from a newer version of Vault to an older version.-When upgrading replicated clusters, ensure that upstream clusters are always on-older versions of Vault than downstream clusters.-</Note>-Here is an example of upgrading four Vault replicated Vault clusters:--In the above scenario, the ideal upgrade procedure would be as follows,-verifying functionality after each cluster upgrade.-1. Upgrade Clusters B and D, using the HA upgrade process above. These clusters-have no downstream clusters, so they should be upgraded first, but the-ordering of B vs D does not matter.-2. Upgrade Cluster C, which now has an upgraded downstream cluster (Cluster D).-Because Cluster C is a cluster, it should also use the HA upgrade process.-3. Finally, upgrade Cluster A. All clusters downstream of A will already be-upgraded. It should be upgraded last, as it is a Performance Primary and a DR-Primary.+See the main [upgrading](/vault/docs/upgrading#enterprise-replication-installations) page.<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>5d13092b038397d5970dcaa411c43defe993ab3a (#21422)website/content/docs/auth/index.mdx | 11 +++++++----1 file changed, 7 insertions(+), 4 deletions(-)
website/content/api-docs/relatedtools.mdx+5 −5
@@ -6,12 +6,13 @@ description: Short list of third-party tools that work with or are related to Va# Related Tools## Hashicorp Tools+## HashiCorp Tools- The [Terraform Vault provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) can read from, write to, and configure Vault from [HashiCorp Terraform](https://www.terraform.io/)+- [Vault Agent](/vault/docs/agent-and-proxy/agent) can render Vault secrets either to files or directly into a child process as environment variables using `consul-template` templating syntax+- [Vault Proxy](/vault/docs/agent-and-proxy/proxy) acts as an API Proxy for Vault, and can optionally allow or force interacting clients to use its automatically authenticated token+- [Terraform Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) can read from, write to, and configure Vault from [HashiCorp Terraform](https://www.terraform.io/)- [consul-template](https://github.com/hashicorp/consul-template) is a template renderer, notifier, and supervisor for HashiCorp Consul and Vault data-- [envconsul](https://github.com/hashicorp/envconsul) allows you to read and set environmental variables for processes from Consul and Vault data-- The [vault-ssh-helper](https://github.com/hashicorp/vault-ssh-helper) can be used to enable one-time passwords for SSH authentication via Vault+- [vault-ssh-helper](https://github.com/hashicorp/vault-ssh-helper) can be used to enable one-time passwords for SSH authentication via Vault## Third-Party Tools@@ -23,7 +24,6 @@ The following list of tools is maintained by the community of Vault users; Hashi- [pouch](https://github.com/tuenti/pouch) - A set of tools to manage provisioning of secrets on hosts based on the AppRole authentication method of Vault- [vault-aws-creds](https://github.com/jantman/vault-aws-creds) - Python helper to export Vault-provided temporary AWS creds into the environment- [goldfish](https://github.com/Caiyeon/goldfish) - A Vault UI panel written with VueJS and Vault native Go API.-- [vaultenv](https://github.com/channable/vaultenv) - A tool that fetches secrets in parallel, puts them into the environment and then `exec`s the process that needs them- [vault-migrator](https://github.com/nebtex/vault-migrator) - A tool to migrate data between different Vault storage mechanisms- [Cryptr](https://github.com/adobe/cryptr) - a desktop Vault UI for Mac, Windows and Linux- [sequelize-vault](https://github.com/linyows/sequelize-vault) - A Sequelize plugin for easily integrating Vault secrets.<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>67927a1e9f0a2145b5a5a1e1a8d6d542fe16b25e (#21355)website/content/docs/upgrading/index.mdx | 40 ++++++++++++++++.../docs/upgrading/vault-ha-upgrade.mdx | 47 ++-----------------2 files changed, 43 insertions(+), 44 deletions(-)
builtin/credential/aws/path_login.go+2 −1
@@ -27,6 +27,7 @@ import (cleanhttp "github.com/hashicorp/go-cleanhttp""github.com/hashicorp/go-retryablehttp""github.com/hashicorp/go-secure-stdlib/awsutil"+"github.com/hashicorp/go-secure-stdlib/parseutil""github.com/hashicorp/go-secure-stdlib/strutil"uuid "github.com/hashicorp/go-uuid""github.com/hashicorp/vault/builtin/credential/aws/pkcs7"@@ -1291,7 +1292,7 @@ func (b *backend) pathLoginRenewEc2(ctx context.Context, req *logical.Request, _// If the login was made using the role tag, then max_ttl from tag// is cached in internal data during login and used here to cap the// max_ttl of renewal.-rTagMaxTTL, err := time.ParseDuration(req.Auth.Metadata["role_tag_max_ttl"])+rTagMaxTTL, err := parseutil.ParseDurationSecond(req.Auth.Metadata["role_tag_max_ttl"])if err != nil {return nil, err}
website/content/docs/secrets/pki/considerations.mdx+5 −0
@@ -323,6 +323,11 @@ To solve this issue, there are two possible approaches:The choice of approach depends on the policies of the organization wishingto use ACME.Another consequence of the Vault unauthenticated nature of ACME requests+are that role templating, based on entity information, cannot be used as+there is no token and thus no entity associated with the request, even when+EAB binding is used.+### ACME and the Public InternetUsing ACME is possible over the public internet; public CAs like Let's Encrypt<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>774d75e63e2481f28f0890f2b4387303ac232755 (#21294).../partials/update-primary-known-issue.mdx | 128 +++++++++---------1 file changed, 64 insertions(+), 64 deletions(-)
More files changed — see the full commit.