Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.
Affected versions
1.8.0 → fixed in 1.8.5
Details
Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
The fix
Release delta 1.8.0 → 1.8.5 (contains the fix)
CHANGELOG.md+69 −28
@@ -1,5 +1,24 @@-## 1.8.0-rc2-### July 15th, 2021+## 1.8.1+### August 5th, 2021+CHANGES:+* go: Update go version to 1.16.6 [[GH-12245](https://github.com/hashicorp/vault/pull/12245)]+IMPROVEMENTS:+* serviceregistration: add `external-source: "vault"` metadata value for Consul registration. [[GH-12163](https://github.com/hashicorp/vault/pull/12163)]+BUG FIXES:+* auth/aws: Remove warning stating AWS Token TTL will be capped by the Default Lease TTL. [[GH-12026](https://github.com/hashicorp/vault/pull/12026)]+* auth/jwt: Fixes OIDC auth from the Vault UI when using `form_post` as the `oidc_response_mode`. [[GH-12258](https://github.com/hashicorp/vault/pull/12258)]+* core (enterprise): Disallow autogenerated licenses to be used in diagnose even when config is specified+* core: fix byte printing for diagnose disk checks [[GH-12229](https://github.com/hashicorp/vault/pull/12229)]+* identity: do not allow a role's token_ttl to be longer than the signing key's verification_ttl [[GH-12151](https://github.com/hashicorp/vault/pull/12151)]+## 1.8.0+### July 28th, 2021CHANGES:@@ -12,23 +31,17 @@ be also set to `true`. Otherwise, the template engine will log an error but thenrestart its internal runner. [[GH-11775](https://github.com/hashicorp/vault/pull/11775)]* agent: Update to use IAM Service Account Credentials endpoint for signing JWTswhen using GCP Auto-Auth method [[GH-11473](https://github.com/hashicorp/vault/pull/11473)]-* go: Update to Go 1.16.5 [[GH-11802](https://github.com/hashicorp/vault/pull/11802)]+* core (enterprise): License/EULA changes that ensure the presence of a valid HashiCorp license to+start Vault. More information is available in the [Vault License FAQ](https://www.vaultproject.io/docs/enterprise/license/faqs)FEATURES:* **GCP Secrets Engine Static Accounts**: Adds ability to use existing service accounts for generation+of service account keys and access tokens. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]+* **Key Management Secrets Engine (Enterprise)**: Adds general availability for distributing and managing keys in AWS KMS. [[GH-11958](https://github.com/hashicorp/vault/pull/11958)]+* **License Autoloading (Enterprise)**: Licenses may now be automatically loaded from the environment or disk.* **MySQL Database UI**: The UI now supports adding and editing MySQL connections in the database secret engine [[GH-11532](https://github.com/hashicorp/vault/pull/11532)]-* cli/api: Add lease lookup command [[GH-11129](https://github.com/hashicorp/vault/pull/11129)]-* core: Add controlled capabilities to control group policy stanza-* secret/rabbitmq: Add ability to customize dynamic usernames [[GH-11899](https://github.com/hashicorp/vault/pull/11899)]-* secrets/database/elasticsearch: Add ability to customize dynamic usernames [[GH-11957](https://github.com/hashicorp/vault/pull/11957)]-* secrets/database/influxdb: Add ability to customize dynamic usernames [[GH-11796](https://github.com/hashicorp/vault/pull/11796)]-* secrets/database/mongodbatlas: Add ability to customize dynamic usernames [[GH-11956](https://github.com/hashicorp/vault/pull/11956)]-* secrets/database/redshift: Add ability to customize dynamic usernames [[GH-12016](https://github.com/hashicorp/vault/pull/12016)]-* secrets/database/snowflake: Add ability to customize dynamic usernames [[GH-11997](https://github.com/hashicorp/vault/pull/11997)]-* secrets/gcp: Adds ability to use existing service accounts for generation of service account keys and access tokens. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]-* secrets/keymgmt (enterprise): Adds general availability for distributing and managing keys in AWS KMS. [[GH-11958](https://github.com/hashicorp/vault/pull/11958)]-* ssh: add support for templated values in SSH CA DefaultExtensions [[GH-11495](https://github.com/hashicorp/vault/pull/11495)]-* ui: Add database secret engine support for MSSQL [[GH-11231](https://github.com/hashicorp/vault/pull/11231)]+* **Vault Diagnose**: A new `vault operator` command to detect common issues with vault server setups.IMPROVEMENTS:@@ -36,24 +49,38 @@ IMPROVEMENTS:* agent: Allow Agent auto auth to read symlinked JWT files [[GH-11502](https://github.com/hashicorp/vault/pull/11502)]* api: Allow a leveled logger to be provided to `api.Client` through `SetLogger`. [[GH-11696](https://github.com/hashicorp/vault/pull/11696)]* auth/aws: Underlying error included in validation failure message. [[GH-11638](https://github.com/hashicorp/vault/pull/11638)]+* cli/api: Add lease lookup command [[GH-11129](https://github.com/hashicorp/vault/pull/11129)]* core: Add `prefix_filter` to telemetry config [[GH-12025](https://github.com/hashicorp/vault/pull/12025)]+* core: Add a darwin/arm64 binary release supporting the Apple M1 CPU [[GH-12071](https://github.com/hashicorp/vault/pull/12071)]* core: Add a small (<1s) exponential backoff to failed TCP listener Accept failures. [[GH-11588](https://github.com/hashicorp/vault/pull/11588)]+* core (enterprise): Add controlled capabilities to control group policy stanza* core: Add metrics for standby node forwarding. [[GH-11366](https://github.com/hashicorp/vault/pull/11366)]+* core: Add metrics to report if a node is a perf standby, if a node is a dr secondary or primary, and if a node is a perf secondary or primary. [[GH-11472](https://github.com/hashicorp/vault/pull/11472)]* core: Send notifications to systemd on start, stop, and configuration reload. [[GH-11517](https://github.com/hashicorp/vault/pull/11517)]* core: add irrevocable lease list and count apis [[GH-11607](https://github.com/hashicorp/vault/pull/11607)]* core: allow arbitrary length stack traces upon receiving SIGUSR2 (was 32MB) [[GH-11364](https://github.com/hashicorp/vault/pull/11364)]* db/cassandra: Added tls_server_name to specify server name for TLS validation [[GH-11820](https://github.com/hashicorp/vault/pull/11820)]-* plugins/ad: Added rotate-role endpoint for manual service account password rotations [[GH-11942](https://github.com/hashicorp/vault/pull/11942)]-* raft: Improve raft batch size selection [[GH-11907](https://github.com/hashicorp/vault/pull/11907)]-* raft: change freelist type to map and set nofreelistsync to true [[GH-11895](https://github.com/hashicorp/vault/pull/11895)]-* replication (enterprise): The log shipper is now memory-as well as length bound, and length and size can be-separately configured.+* go: Update to Go 1.16.5 [[GH-11802](https://github.com/hashicorp/vault/pull/11802)]+* replication: Delay evaluation of X-Vault-Index headers until merkle sync completes.+* secrets/rabbitmq: Add ability to customize dynamic usernames [[GH-11899](https://github.com/hashicorp/vault/pull/11899)]+* secrets/ad: Add `rotate-role` endpoint to allow rotations of service accounts. [[GH-11942](https://github.com/hashicorp/vault/pull/11942)]+* secrets/aws: add IAM tagging support for iam_user roles [[GH-10953](https://github.com/hashicorp/vault/pull/10953)]* secrets/aws: add ability to provide a role session name when generating STS credentials [[GH-11345](https://github.com/hashicorp/vault/pull/11345)]+* secrets/database/elasticsearch: Add ability to customize dynamic usernames [[GH-11957](https://github.com/hashicorp/vault/pull/11957)]+* secrets/database/influxdb: Add ability to customize dynamic usernames [[GH-11796](https://github.com/hashicorp/vault/pull/11796)]* secrets/database/mongodb: Add ability to customize `SocketTimeout`, `ConnectTimeout`, and `ServerSelectionTimeout` [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]* secrets/database/mongodb: Increased throughput by allowing for multiple request threads to simultaneously update users in MongoDB [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]+* secrets/database/mongodbatlas: Adds the ability to customize username generation for dynamic users in MongoDB Atlas. [[GH-11956](https://github.com/hashicorp/vault/pull/11956)]+* secrets/database/redshift: Add ability to customize dynamic usernames [[GH-12016](https://github.com/hashicorp/vault/pull/12016)]+* secrets/database/snowflake: Add ability to customize dynamic usernames [[GH-11997](https://github.com/hashicorp/vault/pull/11997)]+* ssh: add support for templated values in SSH CA DefaultExtensions [[GH-11495](https://github.com/hashicorp/vault/pull/11495)]+* storage/raft: Improve raft batch size selection [[GH-11907](https://github.com/hashicorp/vault/pull/11907)]+* storage/raft: change freelist type to map and set nofreelistsync to true [[GH-11895](https://github.com/hashicorp/vault/pull/11895)]+* storage/raft: Switch to shared raft-boltdb library and add boltdb metrics [[GH-11269](https://github.com/hashicorp/vault/pull/11269)]* storage/raft: Support autopilot for HA only raft storage. [[GH-11260](https://github.com/hashicorp/vault/pull/11260)]+* storage/raft (enterprise): Enable Autopilot on DR secondary clusters* ui: Add Validation to KV secret engine [[GH-11785](https://github.com/hashicorp/vault/pull/11785)]+* ui: Add database secret engine support for MSSQL [[GH-11231](https://github.com/hashicorp/vault/pull/11231)]* ui: Add push notification message when selecting okta auth. [[GH-11442](https://github.com/hashicorp/vault/pull/11442)]* ui: Add regex validation to Transform Template pattern input [[GH-11586](https://github.com/hashicorp/vault/pull/11586)]* ui: Add specific error message if unseal fails due to license [[GH-11705](https://github.com/hashicorp/vault/pull/11705)]@@ -67,6 +94,7 @@ separately configured.* ui: Update ember to latest LTS and upgrade UI dependencies [[GH-11447](https://github.com/hashicorp/vault/pull/11447)]* ui: Update partials to components [[GH-11680](https://github.com/hashicorp/vault/pull/11680)]* ui: Updated ivy code mirror component for consistency [[GH-11500](https://github.com/hashicorp/vault/pull/11500)]+* ui: Updated node to v14, latest stable build [[GH-12049](https://github.com/hashicorp/vault/pull/12049)]* ui: Updated search select component styling [[GH-11360](https://github.com/hashicorp/vault/pull/11360)]* ui: add transform secrets engine to features list [[GH-12003](https://github.com/hashicorp/vault/pull/12003)]* ui: add validations for duplicate path kv engine [[GH-11878](https://github.com/hashicorp/vault/pull/11878)]@@ -75,25 +103,27 @@ separately configured.DEPRECATIONS:* secrets/gcp: Deprecated the `/gcp/token/:roleset` and `/gcp/key/:roleset` paths for generating secrets for rolesets.-Use `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` instead. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]+* secrets/gcp: Deprecated the `/gcp/token/:roleset` and `/gcp/key/:roleset` paths for generating+secrets for rolesets. Use `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` instead. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]BUG FIXES:* activity: Omit wrapping tokens and control groups from client counts [[GH-11826](https://github.com/hashicorp/vault/pull/11826)]* agent/cert: Fix issue where the API client on agent was not honoring certificate-information from the auto-auth config map on renewals or retries. [[GH-11576](https://github.com/hashicorp/vault/pull/11576)]+information from the auto-auth config map on renewals or retries. [[GH-11576](https://github.com/hashicorp/vault/pull/11576)]* agent/template: fix command shell quoting issue [[GH-11838](https://github.com/hashicorp/vault/pull/11838)]* agent: Fixed agent templating to use configured tls servername values [[GH-11288](https://github.com/hashicorp/vault/pull/11288)]* agent: fix timestamp format in log messages from the templating engine [[GH-11838](https://github.com/hashicorp/vault/pull/11838)]* auth/approle: fixing dereference of nil pointer [[GH-11864](https://github.com/hashicorp/vault/pull/11864)]* auth/jwt: Updates the [hashicorp/cap](https://github.com/hashicorp/cap) library to `v0.1.0` to-bring in a verification key caching fix. [[GH-11784](https://github.com/hashicorp/vault/pull/11784)]+bring in a verification key caching fix. [[GH-11784](https://github.com/hashicorp/vault/pull/11784)]+* auth/kubernetes: Fix AliasLookahead to correctly extract ServiceAccount UID when using ephemeral JWTs [[GH-12073](https://github.com/hashicorp/vault/pull/12073)]* auth/ldap: Fix a bug where the LDAP auth method does not return the request_timeout configuration parameter on config read. [[GH-11975](https://github.com/hashicorp/vault/pull/11975)]* cli: Add support for response wrapping in `vault list` and `vault kv list` with output format other than `table`. [[GH-12031](https://github.com/hashicorp/vault/pull/12031)]* cli: vault delete and vault kv delete should support the same output options (e.g. -format) as vault write. [[GH-11992](https://github.com/hashicorp/vault/pull/11992)]* core (enterprise): Fix orphan return value from auth methods executed on performance standby nodes.* core (enterprise): Fix plugins mounted in namespaces being unable to use password policies [[GH-11596](https://github.com/hashicorp/vault/pull/11596)]+* core (enterprise): serialize access to HSM entropy generation to avoid errors in concurrent key generation.* core/metrics: Add generic KV mount support for vault.kv.secret.count telemetry metric [[GH-12020](https://github.com/hashicorp/vault/pull/12020)]* core: Fix cleanup of storage entries from cubbyholes within namespaces. [[GH-11408](https://github.com/hashicorp/vault/pull/11408)]* core: Fix edge cases in the configuration endpoint for barrier key autorotation. [[GH-11541](https://github.com/hashicorp/vault/pull/11541)]@@ -105,6 +135,10 @@ bring in a verification key caching fix. [[GH-11784](https://github.com/hashicor* identity: Use correct mount accessor when refreshing external group memberships. [[GH-11506](https://github.com/hashicorp/vault/pull/11506)]* mongo-db: default username template now strips invalid '.' characters [[GH-11872](https://github.com/hashicorp/vault/pull/11872)]* pki: Only remove revoked entry for certificates during tidy if they are past their NotAfter value [[GH-11367](https://github.com/hashicorp/vault/pull/11367)]+* replication: Fix panic trying to update walState during identity group invalidation.+* replication: Fix: mounts created within a namespace that was part of an Allow+filtering rule would not appear on performance secondary if created after rule+was defined.* secret/pki: use case insensitive domain name comparison as per RFC1035 section 2.3.3* secret: fix the bug where transit encrypt batch doesn't work with key_version [[GH-11628](https://github.com/hashicorp/vault/pull/11628)]* secrets/ad: Forward all creds requests to active node [[GH-76](https://github.com/hashicorp/vault-plugin-secrets-ad/pull/76)] [[GH-11836](https://github.com/hashicorp/vault/pull/11836)]@@ -112,20 +146,29 @@ bring in a verification key caching fix. [[GH-11784](https://github.com/hashicor* secrets/database/cassandra: Fixed issue where the PEM parsing logic of `pem_bundle` and `pem_json` didn't work for CA-only configurations [[GH-11861](https://github.com/hashicorp/vault/pull/11861)]* secrets/database/cassandra: Updated default statement for password rotation to allow for special characters. This applies to root and static credentials. [[GH-11262](https://github.com/hashicorp/vault/pull/11262)]* secrets/database: Fix marshalling to allow providing numeric arguments to external database plugins. [[GH-11451](https://github.com/hashicorp/vault/pull/11451)]+* secrets/database: Fixed an issue that prevented external database plugin processes from restarting after a shutdown. [[GH-12087](https://github.com/hashicorp/vault/pull/12087)]* secrets/database: Fixed minor race condition when rotate-root is called [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]* secrets/database: Fixes issue for V4 database interface where `SetCredentials` wasn't falling back to using `RotateRootCredentials` if `SetCredentials` is `Unimplemented` [[GH-11585](https://github.com/hashicorp/vault/pull/11585)]+* secrets/openldap: Fix bug where schema was not compatible with rotate-root [#24](https://github.com/hashicorp/vault-plugin-secrets-openldap/pull/24) [[GH-12019](https://github.com/hashicorp/vault/pull/12019)]* storage/dynamodb: Handle throttled batch write requests by retrying, without which writes could be lost. [[GH-10181](https://github.com/hashicorp/vault/pull/10181)]* storage/raft: Support cluster address change for nodes in a cluster managed by autopilot [[GH-11247](https://github.com/hashicorp/vault/pull/11247)]* storage/raft: Tweak creation of vault.db file [[GH-12034](https://github.com/hashicorp/vault/pull/12034)]* storage/raft: leader_tls_servername wasn't used unless leader_ca_cert_file and/or mTLS were configured. [[GH-11252](https://github.com/hashicorp/vault/pull/11252)]* tokenutil: Perform the num uses check before token type. [[GH-11647](https://github.com/hashicorp/vault/pull/11647)]* transform (enterprise): Fix an issue with malformed transform configuration-storage when upgrading from 1.5 to 1.6. See Upgrade Notes for 1.6.x.+storage when upgrading from 1.5 to 1.6. See Upgrade Notes for 1.6.x.+* ui: Add role from database connection automatically populates the database for new role [[GH-11119](https://github.com/hashicorp/vault/pull/11119)]* ui: Add root rotation statements support to appropriate database secret engine plugins [[GH-11404](https://github.com/hashicorp/vault/pull/11404)]+* ui: Automatically refresh the page when user logs out [[GH-12035](https://github.com/hashicorp/vault/pull/12035)]+* ui: Fix Version History queryParams on LinkedBlock [[GH-12079](https://github.com/hashicorp/vault/pull/12079)]+* ui: Fix bug where database secret engines with custom names cannot delete connections [[GH-11127](https://github.com/hashicorp/vault/pull/11127)]* ui: Fix bug where the UI does not recognize version 2 KV until refresh, and fix [object Object] error message [[GH-11258](https://github.com/hashicorp/vault/pull/11258)]+* ui: Fix database role CG access [[GH-12111](https://github.com/hashicorp/vault/pull/12111)]+* ui: Fix date display on expired token notice [[GH-11142](https://github.com/hashicorp/vault/pull/11142)]* ui: Fix entity group membership and metadata not showing [[GH-11641](https://github.com/hashicorp/vault/pull/11641)]* ui: Fix error message caused by control group [[GH-11143](https://github.com/hashicorp/vault/pull/11143)]* ui: Fix footer URL linking to the correct version changelog. [[GH-11283](https://github.com/hashicorp/vault/pull/11283)]+* ui: Fix issue where logging in without namespace input causes error [[GH-11094](https://github.com/hashicorp/vault/pull/11094)]* ui: Fix namespace-bug on login [[GH-11182](https://github.com/hashicorp/vault/pull/11182)]* ui: Fix status menu no showing on login [[GH-11213](https://github.com/hashicorp/vault/pull/11213)]* ui: Fix text link URL on database roles list [[GH-11597](https://github.com/hashicorp/vault/pull/11597)]@@ -134,8 +177,6 @@ storage when upgrading from 1.5 to 1.6. See Upgrade Notes for 1.6.x.* ui: fix issue where select-one option was not showing in secrets database role creation [[GH-11294](https://github.com/hashicorp/vault/pull/11294)]* ui: fix oidc login with Safari [[GH-11884](https://github.com/hashicorp/vault/pull/11884)]## 1.7.3-## 1.7.3### June 16th, 2021to 3.11 in test (#12311) (#12313)plugins/database/cassandra/connection_producer_test.go | 2 +-1 file changed, 1 insertion(+), 1 deletion(-)
go.sum+35 −13
@@ -43,8 +43,8 @@ github.com/Azure/azure-sdk-for-go v36.2.0+incompatible/go.mod h1:9XXNKU+eRnpl9mogithub.com/Azure/azure-sdk-for-go v44.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=github.com/Azure/azure-sdk-for-go v51.1.0+incompatible h1:7uk6GWtUqKg6weLv2dbKnzwb0ml1Qn70AdtRccZ543w=github.com/Azure/azure-sdk-for-go v51.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=-github.com/Azure/azure-storage-blob-go v0.11.0 h1:WCTHKKNkHlzm7lzUNXRSD11784LwJqdrxnwWJxsJQHg=-github.com/Azure/azure-storage-blob-go v0.11.0/go.mod h1:A0u4VjtpgZJ7Y7um/+ix2DHBuEKFC6sEIlj0xc13a4Q=+github.com/Azure/azure-storage-blob-go v0.13.0 h1:lgWHvFh+UYBNVQLFHXkvul2f6yOPA9PIH82RTG2cSwc=+github.com/Azure/azure-storage-blob-go v0.13.0/go.mod h1:pA9kNqtjUeQF2zOSu4s//nUdBD+e64lEuc4sVnuOfNs=github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=@@ -187,6 +187,30 @@ github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/github.com/aws/aws-sdk-go v1.37.19 h1:/xKHoSsYfH9qe16pJAHIjqTVpMM2DRSsEt8Ok1bzYiw=github.com/aws/aws-sdk-go v1.37.19/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=+github.com/aws/aws-sdk-go-v2 v1.3.2 h1:RQj8l98yKUm0UV2Wd3w/Ms+TXV9Rs1E6Kr5tRRMfyU4=+github.com/aws/aws-sdk-go-v2 v1.3.2/go.mod h1:7OaACgj2SX3XGWnrIjGlJM22h6yD6MEWKvm7levnnM8=+github.com/aws/aws-sdk-go-v2/config v1.1.5 h1:imDWOGwlIrRpHLallJ9mli2SIQ4egtGKtFUFsuGRIaQ=+github.com/aws/aws-sdk-go-v2/config v1.1.5/go.mod h1:P3F1hku7qzC81txjwXnwOM6Ex6ezkU6+/557Teyb64E=+github.com/aws/aws-sdk-go-v2/credentials v1.1.5 h1:R9v/eN5cXv5yMLC619xRYl5PgCSuy5SarizmM7+qqSA=+github.com/aws/aws-sdk-go-v2/credentials v1.1.5/go.mod h1:Ir1R6tPiR1/2y1hes8yOijFMz54hzSmgcmCDo6F45Qc=+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.0.6 h1:zoOz5V56jO/rGixsCDnrQtAzYRYM2hGA/43U6jVMFbo=+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.0.6/go.mod h1:0+fWMitrmIpENiY8/1DyhdYPUCAPvd9UNz9mtCsEoLQ=+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.1.2 h1:Doa5wabOIDA0XZzBX5yCTAPGwDCVZ8Ux0wh29AUDmN4=+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.1.2/go.mod h1:Azf567f5wBUfUbwpyJJnLM/geFFIzEulGR30L+nQZOE=+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.0.4 h1:8yeByqOL6UWBsOOXsHnW93/ukwL66O008tRfxXxnTwA=+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.0.4/go.mod h1:BCfU3Uo2fhKcMZFp9zU5QQGQxqWCOYmZ/27Dju3S/do=+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.0.6 h1:ldYIsOP4WyjdzW8t6RC/aSieajrlx+3UN3UCZy1KM5Y=+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.0.6/go.mod h1:L0KWr0ASo83PRZu9NaZaDsw3koS6PspKv137DMDZjHo=+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.2.2 h1:aU8H58DoYxNo8R1TaSPTofkuxfQNnoqZmWL+G3+k/vA=+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.2.2/go.mod h1:nnutjMLuna0s3GVY/MAkpLX03thyNER06gXvnMAPj5g=+github.com/aws/aws-sdk-go-v2/service/s3 v1.5.0 h1:VbwXUI3L0hyhVmrFxbDxrs6cBX8TNFX0YxCpooMNjvY=+github.com/aws/aws-sdk-go-v2/service/s3 v1.5.0/go.mod h1:uwA7gs93Qcss43astPUb1eq4RyceNmYWAQjZFDOAMLo=+github.com/aws/aws-sdk-go-v2/service/sso v1.1.5 h1:B7ec5wE4+3Ldkurmq0C4gfQFtElGTG+/iTpi/YPMzi4=+github.com/aws/aws-sdk-go-v2/service/sso v1.1.5/go.mod h1:bpGz0tidC4y39sZkQSkpO/J0tzWCMXHbw6FZ0j1GkWM=+github.com/aws/aws-sdk-go-v2/service/sts v1.2.2 h1:fKw6QSGcFlvZCBPYx3fo4sL0HfTmaT06ZtMHJfQQNQQ=+github.com/aws/aws-sdk-go-v2/service/sts v1.2.2/go.mod h1:ssRzzJ2RZOVuKj2Vx1YE7ypfil/BIlgmQnCSW4DistU=+github.com/aws/smithy-go v1.3.1 h1:xJFO4pK0y9J8fCl34uGsSJX5KNnGbdARDlA5BPhXnwE=+github.com/aws/smithy-go v1.3.1/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f h1:ZNv7On9kyUzm7fvRZumSyy/IUiSC7AzL0I1jKKtwooA=github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=@@ -292,8 +316,6 @@ github.com/denverdino/aliyungo v0.0.0-20170926055100-d3308649c661 h1:lrWnAyy/F72github.com/denverdino/aliyungo v0.0.0-20170926055100-d3308649c661/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=-github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1 h1:CaO/zOnF8VvUfEbhRatPcwKVWamvbYd8tQGRWacE9kU=-github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=github.com/digitalocean/godo v1.7.5 h1:JOQbAO6QT1GGjor0doT0mXefX2FgUDPOpYh2RaXA+ko=github.com/digitalocean/godo v1.7.5/go.mod h1:h6faOIcZ8lWIwNQ+DN7b3CgX4Kwby5T+nbpNqkUIozU=@@ -623,6 +645,8 @@ github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQagithub.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=github.com/hashicorp/go-slug v0.4.1 h1:/jAo8dNuLgSImoLXaX7Od7QB4TfYCVPam+OpAt5bZqc=github.com/hashicorp/go-slug v0.4.1/go.mod h1:I5tq5Lv0E2xcNXNkmx7BSfzi1PsJ2cNjs3cC3LwyhK8=github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=@@ -702,8 +726,8 @@ github.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0 h1:c9/fwjJf9XjXSgithub.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0/go.mod h1:QiQnpM6tI8LqIO+XfI/5AddV7d9cT1DhhOekLV2+AKY=github.com/hashicorp/vault-plugin-database-mongodbatlas v0.4.0 h1:baCsn+MRffmcqkOf3p6Fh0fvw2llXl63Ts4Fl14Vn3A=github.com/hashicorp/vault-plugin-database-mongodbatlas v0.4.0/go.mod h1:ESNBxY0kbC8fZhyfYo0JcIwL4piI5+IZAHvnByceRoY=-github.com/hashicorp/vault-plugin-database-snowflake v0.2.0 h1:qhL7l5NKVwHLl93uCLOpPWBfJMpD+HC6a6Y3mmF0Ki4=-github.com/hashicorp/vault-plugin-database-snowflake v0.2.0/go.mod h1:gUfFbYrFFxITKxeLJe2IHPnNkmSG5ldVF1OOxp1WW3c=+github.com/hashicorp/vault-plugin-database-snowflake v0.2.1 h1:dEUjdnqWW8JIeGYjgdHRMNqX7cRUDdnXXcBUjw/7YG8=+github.com/hashicorp/vault-plugin-database-snowflake v0.2.1/go.mod h1:aXTJUUIdOVU/g3kiQNVAEcRhK5NzieOcYsUhsK6PgTw=github.com/hashicorp/vault-plugin-mock v0.16.1 h1:5QQvSUHxDjEEbrd2REOeacqyJnCLPD51IQzy71hx8P0=github.com/hashicorp/vault-plugin-mock v0.16.1/go.mod h1:83G4JKlOwUtxVourn5euQfze3ZWyXcUiLj2wqrKSDIM=github.com/hashicorp/vault-plugin-secrets-ad v0.10.0 h1:iMS1SfIQtPfvPbw24W8HbNBb6o6wqSRjJwxNcZWEiw0=@@ -815,7 +839,6 @@ github.com/klauspost/compress v1.9.5/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=-github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=@@ -1112,8 +1135,9 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxgithub.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=-github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=+github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=github.com/smartystreets/assertions v0.0.0-20180725160413-e900ae048470/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=@@ -1121,10 +1145,8 @@ github.com/smartystreets/goconvey v0.0.0-20180222194500-ef6db91d284a/go.mod h1:Xgithub.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=-github.com/snowflakedb/glog v0.0.0-20180824191149-f5055e6f21ce h1:CGR1hXCOeoZ1aJhCs8qdKJuEu3xoZnxsLcYoh5Bnr+4=-github.com/snowflakedb/glog v0.0.0-20180824191149-f5055e6f21ce/go.mod h1:EB/w24pR5VKI60ecFnKqXzxX3dOorz1rnVicQTQrGM0=-github.com/snowflakedb/gosnowflake v1.3.11 h1:4VATaWPZv2HEh9bkZG5LaMux4WRiZJDu/PvvMCzrpUg=-github.com/snowflakedb/gosnowflake v1.3.11/go.mod h1:+BMe9ivHWpzcXbM1qSIxWZ8qpWGBBaA46o9Z1qSfrNg=+github.com/snowflakedb/gosnowflake v1.6.1 h1:gaRt3oK7ATFmLgAg6Gw7aKvWhWts3WV33d0YE4Ofh2U=+github.com/snowflakedb/gosnowflake v1.6.1/go.mod h1:1kyg2XEduwti88V11PKRHImhXLK5WpGiayY6lFNYb98=github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d h1:bVQRCxQvfjNUeRqaY/uT0tFuvuFY0ulgnczuR684Xic=github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d/go.mod h1:Cw4GTlQccdRGSEf6KiMju767x0NEHE0YIVPJSaXjlsw=github.com/soheilhy/cmux v0.1.4 h1:0HKaf1o97UwFjHH9o5XsHUOF+tqmdA7KEzXLpiyaw0E=@@ -1281,7 +1303,6 @@ golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhgolang.org/x/crypto v0.0.0-20200117160349-530e935923ad/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=-golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=@@ -1454,6 +1475,7 @@ golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wgolang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=+golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20210514084401-e8d321eab015 h1:hZR0X1kPW+nwyJ9xRxqZk1vx5RUObAPBdKVvXPDUH/E=
CHANGELOG.md+21 −0
@@ -1,3 +1,24 @@+## 1.8.2+### 26 August 2021+CHANGES:+* go: Update go version to 1.16.7 [[GH-12408](https://github.com/hashicorp/vault/pull/12408)]+BUG FIXES:+* auth/aws: Fixes ec2 login no longer supporting DSA signature verification [[GH-12340](https://github.com/hashicorp/vault/pull/12340)]+* cli: vault debug now puts newlines after every captured log line. [[GH-12175](https://github.com/hashicorp/vault/pull/12175)]+* database/couchbase: change default template to truncate username at 128 characters [[GH-12300](https://github.com/hashicorp/vault/pull/12300)]+* identity: Fix a panic on arm64 platform when doing identity I/O. [[GH-12371](https://github.com/hashicorp/vault/pull/12371)]+* physical/raft: Fix safeio.Rename error when restoring snapshots on windows [[GH-12377](https://github.com/hashicorp/vault/pull/12377)]+* plugin/snowflake: Fixed bug where plugin would crash on 32 bit systems [[GH-12378](https://github.com/hashicorp/vault/pull/12378)]+* sdk/database: Fix a DeleteUser error message on the gRPC client. [[GH-12351](https://github.com/hashicorp/vault/pull/12351)]+* secrets/gcp: Fixes a potential panic in the service account policy rollback for rolesets. [[GH-12379](https://github.com/hashicorp/vault/pull/12379)]+* ui: Fixed api explorer routing bug [[GH-12354](https://github.com/hashicorp/vault/pull/12354)]+* ui: Fixes metrics page when read on counter config not allowed [[GH-12348](https://github.com/hashicorp/vault/pull/12348)]+* ui: fix issue where on MaskedInput on auth methods if tab it would clear the value. [[GH-12409](https://github.com/hashicorp/vault/pull/12409)]+## 1.8.1### August 5th, 2021tokens (#12468)changelog/12339.txt | 3 +++vault/auth.go | 10 ++++++----vault/quotas/quotas.go | 5 +++--3 files changed, 12 insertions(+), 6 deletions(-)create mode 100644 changelog/12339.txt
go.sum+2 −3
@@ -475,7 +475,6 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSwgithub.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=-github.com/golang/snappy v0.0.2 h1:aeE13tS0IiQgFjYdoL8qN3K1N2bXXtI6Vi51/y7BpMw=github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=@@ -713,8 +712,8 @@ github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0 h1:EhTRXoWCjM3suD1atK9github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0/go.mod h1:SSkKpSTOMnX84PfgYiWHgwVg+YMhxHNjo+YCJGNBoZk=github.com/hashicorp/vault-plugin-secrets-azure v0.10.0 h1:pJTWKVHYqfnlB3xg3XnnF9BOpj2/J7LC/e0RgiwkwKI=github.com/hashicorp/vault-plugin-secrets-azure v0.10.0/go.mod h1:4jCVjTG809NCQ8mrSnbBtX17gX1Iush+558BVO6MJeo=-github.com/hashicorp/vault-plugin-secrets-gcp v0.10.1 h1:04M7fG2SIyZqIpazX2fLg/wpoprZXMlGAISWVl3o550=-github.com/hashicorp/vault-plugin-secrets-gcp v0.10.1/go.mod h1:psRQ/dm5XatoUKLDUeWrpP9icMJNtu/jmscUr37YGK4=+github.com/hashicorp/vault-plugin-secrets-gcp v0.10.2 h1:+DtlYJTsrFRInQpAo09KkYN64scrextjBiTSunpluo8=+github.com/hashicorp/vault-plugin-secrets-gcp v0.10.2/go.mod h1:psRQ/dm5XatoUKLDUeWrpP9icMJNtu/jmscUr37YGK4=github.com/hashicorp/vault-plugin-secrets-gcpkms v0.9.0 h1:7a0iWuFA/YNinQ1xXogyZHStolxMVtLV+sy1LpEHaZs=github.com/hashicorp/vault-plugin-secrets-gcpkms v0.9.0/go.mod h1:hhwps56f2ATeC4Smgghrc5JH9dXR31b4ehSf1HblP5Q=github.com/hashicorp/vault-plugin-secrets-kv v0.9.0 h1:nCw2IfWw2bWUGFZsNk8BvTEg9k7jDpRn48+VAqjdQ3s=newlines. (#12175) (#12201)changelog/12175.txt | 3 +++command/debug.go | 3 +++2 files changed, 6 insertions(+)create mode 100644 changelog/12175.txt
go.sum+2 −2
@@ -687,8 +687,8 @@ github.com/hashicorp/vault-plugin-auth-cf v0.9.0/go.mod h1:exPUMj8yNohKM7yRiHa7Ogithub.com/hashicorp/vault-plugin-auth-gcp v0.5.1/go.mod h1:eLj92eX8MPI4vY1jaazVLF2sVbSAJ3LRHLRhF/pUmlI=github.com/hashicorp/vault-plugin-auth-gcp v0.10.0 h1:EBvgbyiPXqmmEQqIwkorLLEjvv4GPl6DQ1LdE0zJkh0=github.com/hashicorp/vault-plugin-auth-gcp v0.10.0/go.mod h1:Z+mj9fAqzXfDNxLmMoSS8NheVK7ugLvD8sTHO1GXfCA=-github.com/hashicorp/vault-plugin-auth-jwt v0.10.0 h1:9jzAxMnhTA0xsDE3p7IzUoa9O54ijwDfV/J1D7FpB2U=-github.com/hashicorp/vault-plugin-auth-jwt v0.10.0/go.mod h1:3KxfehLIM7zH19+O8jHJ/QJsLGRzSKRqjsesOJmBuoI=+github.com/hashicorp/vault-plugin-auth-jwt v0.10.1 h1:7hvGSiICXpmp7Ras5glxVVxTDg2dZL+l/jWeBQ6bzr0=+github.com/hashicorp/vault-plugin-auth-jwt v0.10.1/go.mod h1:3KxfehLIM7zH19+O8jHJ/QJsLGRzSKRqjsesOJmBuoI=github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0 h1:7M7/DbFsUoOMBd2/R48ZNj4PM3Gdsg0dGcbMOdt5z1Q=github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0/go.mod h1:h+7pLm4Z2EeKHOGPefX0bGzdUQCMBUlvM/BpSMNgTFw=github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1 h1:7c2ufXt5oXSUISNHpO07W956fpgn00nT1IQFPEP5XQE=CHANGELOG.md | 97 +++++++++++++++++++++++++++++++++++++---------------1 file changed, 69 insertions(+), 28 deletions(-)
go.sum+2 −2
@@ -695,8 +695,8 @@ github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1 h1:7c2ufXt5oXSUISNHpO0github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1/go.mod h1:2c/k3nsoGPKV+zpAWCiajt4e66vncEq8Li/eKLqErAc=github.com/hashicorp/vault-plugin-auth-oci v0.8.0 h1:qYtVYsQlVnqqlCVqZ+CAiFEXuYJqUQCuqcWQVELybZY=github.com/hashicorp/vault-plugin-auth-oci v0.8.0/go.mod h1:Cn5cjR279Y+snw8LTaiLTko3KGrbigRbsQPOd2D5xDw=-github.com/hashicorp/vault-plugin-database-couchbase v0.4.0 h1:N5ChjecnC88mRfT9KehoeSK6xEyzGoL6g9HJnSZKgII=-github.com/hashicorp/vault-plugin-database-couchbase v0.4.0/go.mod h1:Seivjno/BOtkqX41d/DDYtTg6zNoxIgNaUVZ3ObZYi4=+github.com/hashicorp/vault-plugin-database-couchbase v0.4.1 h1:DSFwDOcmgZ+CSgTh4F5AK7p311QHoT1Jebj/z9PNi6g=+github.com/hashicorp/vault-plugin-database-couchbase v0.4.1/go.mod h1:Seivjno/BOtkqX41d/DDYtTg6zNoxIgNaUVZ3ObZYi4=github.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0 h1:c9/fwjJf9XjXSM8WzCKL2fco4jyAudUSM9QIY4hY+5M=github.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0/go.mod h1:QiQnpM6tI8LqIO+XfI/5AddV7d9cT1DhhOekLV2+AKY=github.com/hashicorp/vault-plugin-database-mongodbatlas v0.4.0 h1:baCsn+MRffmcqkOf3p6Fh0fvw2llXl63Ts4Fl14Vn3A=(#12355)changelog/12351.txt | 3 +++sdk/database/dbplugin/v5/grpc_client.go | 2 +-2 files changed, 4 insertions(+), 1 deletion(-)create mode 100644 changelog/12351.txt
go.mod+2 −2
@@ -10,7 +10,7 @@ require (cloud.google.com/go v0.56.0cloud.google.com/go/spanner v1.5.1cloud.google.com/go/storage v1.6.0-github.com/Azure/azure-storage-blob-go v0.11.0+github.com/Azure/azure-storage-blob-go v0.13.0github.com/Azure/go-autorest/autorest v0.11.17github.com/Azure/go-autorest/autorest/adal v0.9.11github.com/Microsoft/hcsshim v0.8.14 // indirect@@ -95,7 +95,7 @@ require (github.com/hashicorp/vault-plugin-database-couchbase v0.4.1github.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0github.com/hashicorp/vault-plugin-database-mongodbatlas v0.4.0-github.com/hashicorp/vault-plugin-database-snowflake v0.2.0+github.com/hashicorp/vault-plugin-database-snowflake v0.2.1github.com/hashicorp/vault-plugin-mock v0.16.1github.com/hashicorp/vault-plugin-secrets-ad v0.10.0github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0
go.mod+1 −1
@@ -88,7 +88,7 @@ require (github.com/hashicorp/vault-plugin-auth-centrify v0.9.0github.com/hashicorp/vault-plugin-auth-cf v0.9.0github.com/hashicorp/vault-plugin-auth-gcp v0.10.0-github.com/hashicorp/vault-plugin-auth-jwt v0.10.0+github.com/hashicorp/vault-plugin-auth-jwt v0.10.1github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1github.com/hashicorp/vault-plugin-auth-oci v0.8.0
go.mod+1 −1
@@ -92,7 +92,7 @@ require (github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1github.com/hashicorp/vault-plugin-auth-oci v0.8.0-github.com/hashicorp/vault-plugin-database-couchbase v0.4.0+github.com/hashicorp/vault-plugin-database-couchbase v0.4.1github.com/hashicorp/vault-plugin-database-elasticsearch v0.8.0github.com/hashicorp/vault-plugin-database-mongodbatlas v0.4.0github.com/hashicorp/vault-plugin-database-snowflake v0.2.0
go.sum+2 −0
@@ -477,6 +477,8 @@ github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lgithub.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/golang/snappy v0.0.2 h1:aeE13tS0IiQgFjYdoL8qN3K1N2bXXtI6Vi51/y7BpMw=github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
sdk/go.mod+1 −1
@@ -12,7 +12,7 @@ require (github.com/go-ldap/ldap/v3 v3.1.10github.com/go-test/deep v1.0.2github.com/golang/protobuf v1.4.2-github.com/golang/snappy v0.0.1+github.com/golang/snappy v0.0.4github.com/hashicorp/errwrap v1.0.0github.com/hashicorp/go-cleanhttp v0.5.1github.com/hashicorp/go-hclog v0.16.1
sdk/go.sum+2 −0
@@ -105,6 +105,8 @@ github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=(#12381)changelog/12377.txt | 3 +++physical/raft/snapshot.go | 17 +++++++++++++++--2 files changed, 18 insertions(+), 2 deletions(-)create mode 100644 changelog/12377.txt
go.mod+1 −1
@@ -100,7 +100,7 @@ require (github.com/hashicorp/vault-plugin-secrets-ad v0.10.0github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0github.com/hashicorp/vault-plugin-secrets-azure v0.10.0-github.com/hashicorp/vault-plugin-secrets-gcp v0.10.1+github.com/hashicorp/vault-plugin-secrets-gcp v0.10.2github.com/hashicorp/vault-plugin-secrets-gcpkms v0.9.0github.com/hashicorp/vault-plugin-secrets-kv v0.9.0github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.4.0
builtin/credential/aws/path_login.go+3 −3
@@ -20,11 +20,11 @@ import (awsClient "github.com/aws/aws-sdk-go/aws/client""github.com/aws/aws-sdk-go/service/ec2""github.com/aws/aws-sdk-go/service/iam"-"github.com/fullsailor/pkcs7""github.com/hashicorp/errwrap"cleanhttp "github.com/hashicorp/go-cleanhttp""github.com/hashicorp/go-retryablehttp"uuid "github.com/hashicorp/go-uuid"+"github.com/hashicorp/vault/builtin/credential/aws/pkcs7""github.com/hashicorp/vault/sdk/framework""github.com/hashicorp/vault/sdk/helper/awsutil""github.com/hashicorp/vault/sdk/helper/cidrutil"@@ -348,8 +348,8 @@ func (b *backend) parseIdentityDocument(ctx context.Context, s logical.Storage,// Verify extracts the authenticated attributes in the PKCS#7 signature, and verifies// the authenticity of the content using 'dsa.PublicKey' embedded in the public certificate.-if pkcs7Data.Verify() != nil {-return nil, fmt.Errorf("failed to verify the signature")+if err := pkcs7Data.Verify(); err != nil {+return nil, fmt.Errorf("failed to verify the signature: %w", err)}// Check if the signature has content inside of it
builtin/credential/aws/pkcs7/sign.go+399 −0
@@ -0,0 +1,429 @@+package pkcs7+import (+"bytes"+"crypto"+"crypto/dsa"+"crypto/rand"+"crypto/x509"+"crypto/x509/pkix"+"encoding/asn1"+"errors"+"fmt"+"math/big"+"time"+)+// SignedData is an opaque data structure for creating signed data payloads+type SignedData struct {+sd signedData+certs []*x509.Certificate+data, messageDigest []byte+digestOid asn1.ObjectIdentifier+encryptionOid asn1.ObjectIdentifier+}+// NewSignedData takes data and initializes a PKCS7 SignedData struct that is+// ready to be signed via AddSigner. The digest algorithm is set to SHA1 by default+// and can be changed by calling SetDigestAlgorithm.+func NewSignedData(data []byte) (*SignedData, error) {+content, err := asn1.Marshal(data)+if err != nil {+return nil, err+}+ci := contentInfo{+ContentType: OIDData,+Content: asn1.RawValue{Class: 2, Tag: 0, Bytes: content, IsCompound: true},+}+sd := signedData{+ContentInfo: ci,+Version: 1,+}+return &SignedData{sd: sd, data: data, digestOid: OIDDigestAlgorithmSHA1}, nil+}+// SignerInfoConfig are optional values to include when adding a signer+type SignerInfoConfig struct {+ExtraSignedAttributes []Attribute+ExtraUnsignedAttributes []Attribute+}+type signedData struct {+Version int `asn1:"default:1"`+DigestAlgorithmIdentifiers []pkix.AlgorithmIdentifier `asn1:"set"`+ContentInfo contentInfo+Certificates rawCertificates `asn1:"optional,tag:0"`+CRLs []pkix.CertificateList `asn1:"optional,tag:1"`+SignerInfos []signerInfo `asn1:"set"`+}+type signerInfo struct {+Version int `asn1:"default:1"`+IssuerAndSerialNumber issuerAndSerial+DigestAlgorithm pkix.AlgorithmIdentifier+AuthenticatedAttributes []attribute `asn1:"optional,omitempty,tag:0"`+DigestEncryptionAlgorithm pkix.AlgorithmIdentifier+EncryptedDigest []byte+UnauthenticatedAttributes []attribute `asn1:"optional,omitempty,tag:1"`+}+type attribute struct {+Type asn1.ObjectIdentifier+Value asn1.RawValue `asn1:"set"`+}+func marshalAttributes(attrs []attribute) ([]byte, error) {+encodedAttributes, err := asn1.Marshal(struct {+A []attribute `asn1:"set"`+}{A: attrs})+if err != nil {+return nil, err+}+// Remove the leading sequence octets+var raw asn1.RawValue+asn1.Unmarshal(encodedAttributes, &raw)+return raw.Bytes, nil+}+type rawCertificates struct {+Raw asn1.RawContent+}+type issuerAndSerial struct {+IssuerName asn1.RawValue+SerialNumber *big.Int+}+// SetDigestAlgorithm sets the digest algorithm to be used in the signing process.+//+// This should be called before adding signers+func (sd *SignedData) SetDigestAlgorithm(d asn1.ObjectIdentifier) {+sd.digestOid = d+}+// SetEncryptionAlgorithm sets the encryption algorithm to be used in the signing process.+//+// This should be called before adding signers+func (sd *SignedData) SetEncryptionAlgorithm(d asn1.ObjectIdentifier) {+sd.encryptionOid = d+}+// AddSigner is a wrapper around AddSignerChain() that adds a signer without any parent.+func (sd *SignedData) AddSigner(ee *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error {+var parents []*x509.Certificate+return sd.AddSignerChain(ee, pkey, parents, config)+}+// AddSignerChain signs attributes about the content and adds certificates+// and signers infos to the Signed Data. The certificate and private key+// of the end-entity signer are used to issue the signature, and any+// parent of that end-entity that need to be added to the list of+// certifications can be specified in the parents slice.+//+// The signature algorithm used to hash the data is the one of the end-entity+// certificate.+func (sd *SignedData) AddSignerChain(ee *x509.Certificate, pkey crypto.PrivateKey, parents []*x509.Certificate, config SignerInfoConfig) error {+// Following RFC 2315, 9.2 SignerInfo type, the distinguished name of+// the issuer of the end-entity signer is stored in the issuerAndSerialNumber+// section of the SignedData.SignerInfo, alongside the serial number of+// the end-entity.+var ias issuerAndSerial+ias.SerialNumber = ee.SerialNumber+if len(parents) == 0 {+// no parent, the issuer is the end-entity cert itself+ias.IssuerName = asn1.RawValue{FullBytes: ee.RawIssuer}+} else {+err := verifyPartialChain(ee, parents)+if err != nil {+return err+}+// the first parent is the issuer+ias.IssuerName = asn1.RawValue{FullBytes: parents[0].RawSubject}+}+sd.sd.DigestAlgorithmIdentifiers = append(sd.sd.DigestAlgorithmIdentifiers,+pkix.AlgorithmIdentifier{Algorithm: sd.digestOid},+)+hash, err := getHashForOID(sd.digestOid)+if err != nil {+return err+}+h := hash.New()+h.Write(sd.data)+sd.messageDigest = h.Sum(nil)+encryptionOid, err := getOIDForEncryptionAlgorithm(pkey, sd.digestOid)+if err != nil {+return err+}+attrs := &attributes{}+attrs.Add(OIDAttributeContentType, sd.sd.ContentInfo.ContentType)+attrs.Add(OIDAttributeMessageDigest, sd.messageDigest)+attrs.Add(OIDAttributeSigningTime, time.Now().UTC())+for _, attr := range config.ExtraSignedAttributes {+attrs.Add(attr.Type, attr.Value)+}+finalAttrs, err := attrs.ForMarshalling()+if err != nil {+return err+}+unsignedAttrs := &attributes{}+for _, attr := range config.ExtraUnsignedAttributes {+unsignedAttrs.Add(attr.Type, attr.Value)+}+finalUnsignedAttrs, err := unsignedAttrs.ForMarshalling()+if err != nil {+return err+}+// create signature of signed attributes+signature, err := signAttributes(finalAttrs, pkey, hash)+if err != nil {+return err+}+signer := signerInfo{+AuthenticatedAttributes: finalAttrs,+UnauthenticatedAttributes: finalUnsignedAttrs,+DigestAlgorithm: pkix.AlgorithmIdentifier{Algorithm: sd.digestOid},+DigestEncryptionAlgorithm: pkix.AlgorithmIdentifier{Algorithm: encryptionOid},+IssuerAndSerialNumber: ias,+EncryptedDigest: signature,+Version: 1,+}+sd.certs = append(sd.certs, ee)+if len(parents) > 0 {+sd.certs = append(sd.certs, parents...)+}+sd.sd.SignerInfos = append(sd.sd.SignerInfos, signer)+return nil+}+// SignWithoutAttr issues a signature on the content of the pkcs7 SignedData.+// Unlike AddSigner/AddSignerChain, it calculates the digest on the data alone+// and does not include any signed attributes like timestamp and so on.+//+// This function is needed to sign old Android APKs, something you probably+// shouldn't do unless you're maintaining backward compatibility for old+// applications.+func (sd *SignedData) SignWithoutAttr(ee *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error {+var signature []byte+sd.sd.DigestAlgorithmIdentifiers = append(sd.sd.DigestAlgorithmIdentifiers, pkix.AlgorithmIdentifier{Algorithm: sd.digestOid})+hash, err := getHashForOID(sd.digestOid)+if err != nil {+return err+}+h := hash.New()+h.Write(sd.data)+sd.messageDigest = h.Sum(nil)+switch pkey := pkey.(type) {+case *dsa.PrivateKey:+// dsa doesn't implement crypto.Signer so we make a special case+// https://github.com/golang/go/issues/27889+r, s, err := dsa.Sign(rand.Reader, pkey, sd.messageDigest)+if err != nil {+return err+}+signature, err = asn1.Marshal(dsaSignature{r, s})+if err != nil {+return err+}+default:+key, ok := pkey.(crypto.Signer)+if !ok {+return errors.New("pkcs7: private key does not implement crypto.Signer")+}+signature, err = key.Sign(rand.Reader, sd.messageDigest, hash)+if err != nil {+return err+}+}+var ias issuerAndSerial+ias.SerialNumber = ee.SerialNumber+// no parent, the issue is the end-entity cert itself+ias.IssuerName = asn1.RawValue{FullBytes: ee.RawIssuer}+if sd.encryptionOid == nil {+// if the encryption algorithm wasn't set by SetEncryptionAlgorithm,+// infer it from the digest algorithm+sd.encryptionOid, err = getOIDForEncryptionAlgorithm(pkey, sd.digestOid)+}+if err != nil {+return err+}+signer := signerInfo{+DigestAlgorithm: pkix.AlgorithmIdentifier{Algorithm: sd.digestOid},+DigestEncryptionAlgorithm: pkix.AlgorithmIdentifier{Algorithm: sd.encryptionOid},+IssuerAndSerialNumber: ias,+EncryptedDigest: signature,+Version: 1,+}+// create signature of signed attributes+sd.certs = append(sd.certs, ee)+sd.sd.SignerInfos = append(sd.sd.SignerInfos, signer)+return nil+}+func (si *signerInfo) SetUnauthenticatedAttributes(extraUnsignedAttrs []Attribute) error {+unsignedAttrs := &attributes{}+for _, attr := range extraUnsignedAttrs {+unsignedAttrs.Add(attr.Type, attr.Value)+}+finalUnsignedAttrs, err := unsignedAttrs.ForMarshalling()+if err != nil {+return err+}+si.UnauthenticatedAttributes = finalUnsignedAttrs+return nil+}+// AddCertificate adds the certificate to the payload. Useful for parent certificates+func (sd *SignedData) AddCertificate(cert *x509.Certificate) {+sd.certs = append(sd.certs, cert)+}+// Detach removes content from the signed data struct to make it a detached signature.+// This must be called right before Finish()+func (sd *SignedData) Detach() {+sd.sd.ContentInfo = contentInfo{ContentType: OIDData}+}+// GetSignedData returns the private Signed Data+func (sd *SignedData) GetSignedData() *signedData {+return &sd.sd+}+// Finish marshals the content and its signers+func (sd *SignedData) Finish() ([]byte, error) {+sd.sd.Certificates = marshalCertificates(sd.certs)+inner, err := asn1.Marshal(sd.sd)+if err != nil {+return nil, err+}+outer := contentInfo{+ContentType: OIDSignedData,+Content: asn1.RawValue{Class: 2, Tag: 0, Bytes: inner, IsCompound: true},+}+return asn1.Marshal(outer)+}+// RemoveAuthenticatedAttributes removes authenticated attributes from signedData+// similar to OpenSSL's PKCS7_NOATTR or -noattr flags+func (sd *SignedData) RemoveAuthenticatedAttributes() {+for i := range sd.sd.SignerInfos {+sd.sd.SignerInfos[i].AuthenticatedAttributes = nil+}+}+// RemoveUnauthenticatedAttributes removes unauthenticated attributes from signedData+func (sd *SignedData) RemoveUnauthenticatedAttributes() {+for i := range sd.sd.SignerInfos {+sd.sd.SignerInfos[i].UnauthenticatedAttributes = nil+}+}+// verifyPartialChain checks that a given cert is issued by the first parent in the list,+// then continue down the path. It doesn't require the last parent to be a root CA,+// or to be trusted in any truststore. It simply verifies that the chain provided, albeit+// partial, makes sense.+func verifyPartialChain(cert *x509.Certificate, parents []*x509.Certificate) error {+if len(parents) == 0 {+return fmt.Errorf("pkcs7: zero parents provided to verify the signature of certificate %q", cert.Subject.CommonName)+}+err := cert.CheckSignatureFrom(parents[0])+if err != nil {+return fmt.Errorf("pkcs7: certificate signature from parent is invalid: %v", err)+}+if len(parents) == 1 {+// there is no more parent to check, return+return nil+}+return verifyPartialChain(parents[0], parents[1:])+}+func cert2issuerAndSerial(cert *x509.Certificate) (issuerAndSerial, error) {+var ias issuerAndSerial+// The issuer RDNSequence has to match exactly the sequence in the certificate+// We cannot use cert.Issuer.ToRDNSequence() here since it mangles the sequence+ias.IssuerName = asn1.RawValue{FullBytes: cert.RawIssuer}+ias.SerialNumber = cert.SerialNumber+return ias, nil+}+// signs the DER encoded form of the attributes with the private key+func signAttributes(attrs []attribute, pkey crypto.PrivateKey, digestAlg crypto.Hash) ([]byte, error) {+attrBytes, err := marshalAttributes(attrs)+if err != nil {+return nil, err+}+h := digestAlg.New()+h.Write(attrBytes)+hash := h.Sum(nil)+// dsa doesn't implement crypto.Signer so we make a special case+// https://github.com/golang/go/issues/27889+switch pkey := pkey.(type) {+case *dsa.PrivateKey:+r, s, err := dsa.Sign(rand.Reader, pkey, hash)+if err != nil {+return nil, err+}+return asn1.Marshal(dsaSignature{r, s})+}+key, ok := pkey.(crypto.Signer)+if !ok {+return nil, errors.New("pkcs7: private key does not implement crypto.Signer")+}+return key.Sign(rand.Reader, hash, digestAlg)+}+type dsaSignature struct {+R, S *big.Int+}+// concats and wraps the certificates in the RawValue structure+func marshalCertificates(certs []*x509.Certificate) rawCertificates {+var buf bytes.Buffer+for _, cert := range certs {+buf.Write(cert.Raw)+}+rawCerts, _ := marshalCertificateBytes(buf.Bytes())+return rawCerts+}+// Even though, the tag & length are stripped out during marshalling the+// RawContent, we have to encode it into the RawContent. If its missing,+// then `asn1.Marshal()` will strip out the certificate wrapper instead.+func marshalCertificateBytes(certs []byte) (rawCertificates, error) {+var val = asn1.RawValue{Bytes: certs, Class: 2, Tag: 0, IsCompound: true}+b, err := asn1.Marshal(val)… diff truncated
More files changed — see the full commit.
References
- ADVISORYhttps://github.com/advisories/GHSA-362v-wg5p-64w2
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-42135
- WEBhttps://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards
- WEBhttps://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180