Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.
Affected versions
0 → fixed in 1.6.61.7.0 → fixed in 1.7.4
Details
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
The fix
Release delta 1.7.0 → 1.7.4 (contains the fix)
go.sum+2 −30
@@ -40,7 +40,6 @@ git.apache.org/thrift.git v0.12.0/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblgithub.com/Azure/azure-pipeline-go v0.2.3 h1:7U9HBg1JFK3jHl5qmo4CTZKFTVgMwdFHMVtCdfBE21U=github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=github.com/Azure/azure-sdk-for-go v36.2.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=-github.com/Azure/azure-sdk-for-go v44.0.0+incompatible h1:e82Yv2HNpS0kuyeCrV29OPKvEiqfs2/uJHic3/3iKdg=github.com/Azure/azure-sdk-for-go v44.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=github.com/Azure/azure-sdk-for-go v51.1.0+incompatible h1:7uk6GWtUqKg6weLv2dbKnzwb0ml1Qn70AdtRccZ543w=github.com/Azure/azure-sdk-for-go v51.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=@@ -65,19 +64,16 @@ github.com/Azure/go-autorest/autorest/adal v0.8.1/go.mod h1:ZjhuQClTqx435SRJ2iMlgithub.com/Azure/go-autorest/autorest/adal v0.8.2/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q=github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=github.com/Azure/go-autorest/autorest/adal v0.9.2/go.mod h1:/3SMAM86bP6wC9Ev35peQDUeqFZBMH07vvUOmg4z/fE=-github.com/Azure/go-autorest/autorest/adal v0.9.5 h1:Y3bBUV4rTuxenJJs41HU3qmqsb+auo+a3Lz+PlJPpL0=github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=github.com/Azure/go-autorest/autorest/adal v0.9.11 h1:L4/pmq7poLdsy41Bj1FayKvBhayuWRYkx9HU5i4Ybl0=github.com/Azure/go-autorest/autorest/adal v0.9.11/go.mod h1:nBKAnTomx8gDtl+3ZCJv2v0KACFHWTB2drffI1B68Pk=github.com/Azure/go-autorest/autorest/azure/auth v0.4.0/go.mod h1:Oo5cRhLvZteXzI2itUm5ziqsoIxRkzrt3t61FeZaS18=github.com/Azure/go-autorest/autorest/azure/auth v0.4.2/go.mod h1:90gmfKdlmKgfjUpnCEpOJzsUEjrWDSLwHIG73tSXddM=-github.com/Azure/go-autorest/autorest/azure/auth v0.5.0 h1:nSMjYIe24eBYasAIxt859TxyXef/IqoH+8/g4+LmcVs=github.com/Azure/go-autorest/autorest/azure/auth v0.5.0/go.mod h1:QRTvSZQpxqm8mSErhnbI+tANIBAKP7B+UIE2z4ypUO0=github.com/Azure/go-autorest/autorest/azure/auth v0.5.7 h1:8DQB8yl7aLQuP+nuR5e2RO6454OvFlSTXXaNHshc16s=github.com/Azure/go-autorest/autorest/azure/auth v0.5.7/go.mod h1:AkzUsqkrdmNhfP2i54HqINVQopw0CLDnvHpJ88Zz1eI=github.com/Azure/go-autorest/autorest/azure/cli v0.3.0/go.mod h1:rNYMNAefZMRowqCV0cVhr/YDW5dD7afFq9nXAXL4ykE=github.com/Azure/go-autorest/autorest/azure/cli v0.3.1/go.mod h1:ZG5p860J94/0kI9mNJVoIoLgXcirM2gF5i2kWloofxw=-github.com/Azure/go-autorest/autorest/azure/cli v0.4.0 h1:Ml+UCrnlKD+cJmSzrZ/RDcDw86NjkRUpnFh7V5JUhzU=github.com/Azure/go-autorest/autorest/azure/cli v0.4.0/go.mod h1:JljT387FplPzBA31vUcvsetLKF3pec5bdAxjVU4kI2s=github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 h1:dMOmEJfkLKW/7JsokJqkyoYSgmR08hi9KrhjZb+JALY=github.com/Azure/go-autorest/autorest/azure/cli v0.4.2/go.mod h1:7qkJkT+j6b+hIpzMOwPChJhTqS8VbsqqgULzMNRugoM=@@ -95,7 +91,6 @@ github.com/Azure/go-autorest/autorest/to v0.3.0/go.mod h1:MgwOyqaIuKdG4TL/2ywSsIgithub.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=-github.com/Azure/go-autorest/autorest/validation v0.3.0 h1:3I9AAI63HfcLtphd9g39ruUwRI+Ca+z/f36KHPFRUss=github.com/Azure/go-autorest/autorest/validation v0.3.0/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=@@ -120,11 +115,9 @@ github.com/Masterminds/semver v1.4.2 h1:WBLTQ37jOCzSLtXNdoo8bNM8876KhNqOKvrlGITggithub.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=github.com/Microsoft/go-winio v0.4.13/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA=github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331 h1:3YnB7Hpmh1lPecPE8doMOtYCrMdrpedZOvxfuNES/Vk=github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=-github.com/Microsoft/hcsshim v0.8.9 h1:VrfodqvztU8YSOvygU+DN1BGaSGxmrNfqOv5oOuX2Bk=github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=github.com/Microsoft/hcsshim v0.8.14 h1:lbPVK25c1cu5xTLITwpUcxoA9vKrKErASPYygvouJns=github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=@@ -186,7 +179,6 @@ github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQgithub.com/aws/aws-sdk-go v1.25.41/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=github.com/aws/aws-sdk-go v1.30.27/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=-github.com/aws/aws-sdk-go v1.34.28 h1:sscPpn/Ns3i0F4HPEWAVcwdIRaZZCuL7llJ2/60yPIk=github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=github.com/aws/aws-sdk-go v1.37.19 h1:/xKHoSsYfH9qe16pJAHIjqTVpMM2DRSsEt8Ok1bzYiw=github.com/aws/aws-sdk-go v1.37.19/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=@@ -247,13 +239,10 @@ github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zgithub.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0 h1:sDMmm+q/3+BukdIpxwO365v/Rbspp2Nt5XntgQRXq8Q=github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0/go.mod h1:4Zcjuz89kmFXt9morQgcfYZAYZ5n8WHjt81YYWIwtTM=-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f h1:tSNMc+rJDfmYntojat8lljbt1mgKNpTxUZJsSzJ9Y1s=github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=-github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59 h1:qWj4qVYZ95vLWwqyNJCQg7rDsG5wPdze0UaPolH7DUk=github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=-github.com/containerd/containerd v1.3.4 h1:3o0smo5SKY7H6AJCmJhsnCjR2/V2T8VmiHt7seN2/kI=github.com/containerd/containerd v1.3.4/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=github.com/containerd/containerd v1.4.3 h1:ijQT13JedHSHrQGWFcGEwzcNKrAGIiZ+jSD5QQG07SY=github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=@@ -262,12 +251,9 @@ github.com/containerd/continuity v0.0.0-20190827140505-75bee3e2ccb6/go.mod h1:GLgithub.com/containerd/continuity v0.0.0-20200709052629-daa8e1ccc0bc/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe h1:PEmIrUvwG9Yyv+0WKZqjXfSFDeZjs/q15g0m08BYS9k=github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=-github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448 h1:PUD50EuOMkXVcpBIA/R95d56duJR9VxhwncsFbNnxW4=github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=-github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de h1:dlfGmNcE3jDAecLqwKPMNX6nk2qh1c1Vg1/YTzpOOF4=github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=-github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd h1:JNn81o/xG+8NEo3bC/vx9pbi/g2WI8mtP2/nXzu297Y=github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=@@ -307,7 +293,6 @@ github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=github.com/digitalocean/godo v1.7.5 h1:JOQbAO6QT1GGjor0doT0mXefX2FgUDPOpYh2RaXA+ko=github.com/digitalocean/godo v1.7.5/go.mod h1:h6faOIcZ8lWIwNQ+DN7b3CgX4Kwby5T+nbpNqkUIozU=-github.com/dimchansky/utfbom v1.1.0 h1:FcM3g+nofKgUteL8dm/UpdRXNC9KmADgTpLKsu0TRo4=github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=@@ -374,7 +359,6 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEgithub.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 h1:Mn26/9ZMNWSw9C9ERFA1PUxfmGpolnw2v0bKOREu5ew=github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=-github.com/go-asn1-ber/asn1-ber v1.4.1 h1:qP/QDxOtmMoJVgXHCXNzDpA0+wkgYB2x5QoLMVOciyw=github.com/go-asn1-ber/asn1-ber v1.4.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=github.com/go-asn1-ber/asn1-ber v1.5.1 h1:pDbRAunXzIUXfx4CB2QJFv5IuPiuoW+sWvr/Us009o8=github.com/go-asn1-ber/asn1-ber v1.5.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=@@ -388,7 +372,6 @@ github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=github.com/go-ldap/ldap/v3 v3.1.3/go.mod h1:3rbOH3jRS2u6jg2rJnKAMLE/xQyCKIveG2Sa/Cohzb8=github.com/go-ldap/ldap/v3 v3.1.7/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q=-github.com/go-ldap/ldap/v3 v3.1.10 h1:7WsKqasmPThNvdl0Q5GPpbTDD/ZD98CfuawrMIuh7qQ=github.com/go-ldap/ldap/v3 v3.1.10/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q=github.com/go-ldap/ldap/v3 v3.2.4 h1:PFavAq2xTgzo/loE8qNXcQaofAaqIpI4WgaLdv+1l3E=github.com/go-ldap/ldap/v3 v3.2.4/go.mod h1:iYS1MdmrmceOJ1QOTnRXrIs7i3kloqtmGQjRvjKpyMg=@@ -584,7 +567,6 @@ github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvgithub.com/hashicorp/go-bindata v3.0.8-0.20180209072458-bf7910af8997+incompatible h1:EDTAuh27kAIhxuyK8ef3iHQARA+8NQaXyTeDEiG3Q6o=github.com/hashicorp/go-bindata v3.0.8-0.20180209072458-bf7910af8997+incompatible/go.mod h1:+IrDq36jUYG0q6TsDY9uO2p77C8f8S5y+RbYHr2UI+U=github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=-github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=@@ -600,7 +582,6 @@ github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjgithub.com/hashicorp/go-hclog v0.9.1/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=-github.com/hashicorp/go-hclog v0.14.1 h1:nQcJDQwIAGnmoUWp8ubocEX40cCml/17YkF6csQLReU=github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=github.com/hashicorp/go-hclog v0.15.0 h1:qMuK0wxsoW4D0ddCCYwPSTm4KQv1X1ke3WmPWZ0Mvsk=github.com/hashicorp/go-hclog v0.15.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=@@ -679,7 +660,6 @@ github.com/hashicorp/raft-boltdb v0.0.0-20171010151810-6e5ba93211ea/go.mod h1:pNgithub.com/hashicorp/raft-snapshot v1.0.3 h1:lTgBBGMFcuKBTwHqWZ4r0TLzNsqo/OByCga/kM6F0uM=github.com/hashicorp/raft-snapshot v1.0.3/go.mod h1:5sL9eUn72lH5DzsFIJ9jaysITbHksSSszImWSOTC8Ic=github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=-github.com/hashicorp/serf v0.9.4 h1:xrZ4ZR0wT5Dz8oQHHdfOzr0ei1jMToWlFFz3hh/DI7I=github.com/hashicorp/serf v0.9.4/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=github.com/hashicorp/serf v0.9.5 h1:EBWvyu9tcRszt3Bxp3KNssBMP1KuHWyO51lz9+786iM=github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=@@ -694,8 +674,8 @@ github.com/hashicorp/vault-plugin-auth-cf v0.8.0/go.mod h1:exPUMj8yNohKM7yRiHa7Ogithub.com/hashicorp/vault-plugin-auth-gcp v0.5.1/go.mod h1:eLj92eX8MPI4vY1jaazVLF2sVbSAJ3LRHLRhF/pUmlI=github.com/hashicorp/vault-plugin-auth-gcp v0.9.0 h1:57uJ2Vqo+M+W7pD8xEONKJ1BBGS8V4xpm7VU56A9RWA=github.com/hashicorp/vault-plugin-auth-gcp v0.9.0/go.mod h1:sHDguHmyGScoalGLEjuxvDCrMPVlw2c3f+ieeiHcv6w=-github.com/hashicorp/vault-plugin-auth-jwt v0.9.2 h1:ghOYlco5t4q+rNecMWC5Cb8jguLiig168jYlBc5QtKk=-github.com/hashicorp/vault-plugin-auth-jwt v0.9.2/go.mod h1:Gn6ELc1X5nmZ/pxoXf0nA4lG2gwuGnY6SNyW40tR/ws=+github.com/hashicorp/vault-plugin-auth-jwt v0.9.3 h1:ZErbJ0Zf+GNavs+75FQn9VuPqEn81NvG5t4FskGyEeQ=+github.com/hashicorp/vault-plugin-auth-jwt v0.9.3/go.mod h1:Gn6ELc1X5nmZ/pxoXf0nA4lG2gwuGnY6SNyW40tR/ws=github.com/hashicorp/vault-plugin-auth-kerberos v0.3.0 h1:QxW0gRevydrNfRvo1qI6p0jQkhedLUgiWqpCN36RXoQ=github.com/hashicorp/vault-plugin-auth-kerberos v0.3.0/go.mod h1:h+7pLm4Z2EeKHOGPefX0bGzdUQCMBUlvM/BpSMNgTFw=github.com/hashicorp/vault-plugin-auth-kubernetes v0.9.0 h1:X/eXFuJqVW8YN73ohTaI5YyCwcjd6C3mpnMv/elkNrw=@@ -871,7 +851,6 @@ github.com/mholt/archiver v3.1.1+incompatible/go.mod h1:Dh2dOXnSdiLxRiPoVfIr/fI1github.com/michaelklishin/rabbit-hole v0.0.0-20191008194146-93d9988f0cd5 h1:uA3b4GgZMZxAJsTkd+CVQ85b7KBlD7HLpd/FfTNlGN0=github.com/michaelklishin/rabbit-hole v0.0.0-20191008194146-93d9988f0cd5/go.mod h1:+pmbihVqjC3GPdfWv1V2TnRSuVvwrWLKfEP/MZVB/Wc=github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=-github.com/miekg/dns v1.1.26 h1:gPxPSwALAeHJSjarOs00QjVdV9QoBvc1D2ujQUr5BzU=github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=github.com/miekg/dns v1.1.40 h1:pyyPFfGMnciYUk/mXpKkVmeMQjfXqt3FAJ2hy7tPiLA=github.com/miekg/dns v1.1.40/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=@@ -976,9 +955,7 @@ github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5Xgithub.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=github.com/opencontainers/runc v1.0.0-rc9 h1:/k06BMULKF5hidyoZymkoDCzdJzltZpz/UU4LguQVtc=github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=-github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700 h1:eNUVfm/RFLIi1G7flU5/ZRTHvd4kcVuzfRnL6OFlzCI=github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=-github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=github.com/openlyinc/pointy v1.1.2 h1:LywVV2BWC5Sp5v7FoP4bUD+2Yn5k0VNeRbU5vq9jUMY=github.com/openlyinc/pointy v1.1.2/go.mod h1:w2Sytx+0FVuMKn37xpXIAyBNhFNBIJGR/v2m7ik1WtM=@@ -1218,7 +1195,6 @@ go.etcd.io/etcd v0.5.0-alpha.5.0.20200425165423-262c93980547 h1:s71VGheLtWmCYsnNgo.etcd.io/etcd v0.5.0-alpha.5.0.20200425165423-262c93980547/go.mod h1:YoUyTScD3Vcv2RBm3eGVOq7i1ULiz3OuXoQFWOirmAM=go.mongodb.org/atlas v0.7.1 h1:hNBtwtKgmhB9vmSX/JyN/cArmhzyy4ihKpmXSMIc4mw=go.mongodb.org/atlas v0.7.1/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=-go.mongodb.org/mongo-driver v1.4.2 h1:WlnEglfTg/PfPq4WXs2Vkl/5ICC6hoG8+r+LraPmGk4=go.mongodb.org/mongo-driver v1.4.2/go.mod h1:WcMNYLx/IlOxLe6JRJiv2uXuCz6zBLndR4SoGjYphSc=go.mongodb.org/mongo-driver v1.4.6 h1:rh7GdYmDrb8AQSkF8yteAus8qYOgOASWDOv1BWqBXkU=go.mongodb.org/mongo-driver v1.4.6/go.mod h1:WcMNYLx/IlOxLe6JRJiv2uXuCz6zBLndR4SoGjYphSc=@@ -1273,7 +1249,6 @@ golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d/go.mod h1:LzIPMQfyMNhhGPhgolang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=-golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 h1:hb9wdF1z5waM+dSIICn1l0DkLVDT3hqhhQsDNUmHPRE=golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 h1:/ZScEX8SfEmUGRHs0gxpqteO5nfNW6axyZbBdw9A12g=@@ -1350,7 +1325,6 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=-golang.org/x/net v0.0.0-20201002202402-0a1ea396d57c h1:dk0ukUIHmGHqASjP0iue2261isepFCC6XRCSd1nHgDw=golang.org/x/net v0.0.0-20201002202402-0a1ea396d57c/go.mod h1:iQL9McJNjoIa5mjH6nYTCTZXUN6RP+XW3eib7Ya3XcI=golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=@@ -1447,7 +1421,6 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=golang.org/x/text v0.3.5 h1:i6eZZ+zk0SOf0xgBpEpPD18qWcJda6q1sxt3S0kzyUQ=golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=@@ -1611,7 +1584,6 @@ google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=-gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d h1:TxyelI5cVkbREznMhfzycHdkp5cLA7DpE+GKjSslYhM=gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
vendor/go.uber.org/goleak/go.sum+30 −0
@@ -0,0 +1,30 @@+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=+golang.org/x/lint v0.0.0-20190930215403-16217165b5de h1:5hukYrvBGR8/eNkX5mdUezrA6JiaEZDtJb9Ei+1LlBs=+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11 h1:Yq9t9jnGoR+dBuitxdo9l6Q7xh/zOyNnYUtDKaQ3x0E=+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
CHANGELOG.md+15 −3
@@ -1,15 +1,21 @@-## 1.7.0-rc1-### 10 March 2021+## 1.7.0+### 24 March 2021CHANGES:* go: Update go version to 1.15.8 [[GH-11060](https://github.com/hashicorp/vault/pull/11060)]+* go: Update Go version to 1.15.10 [[GH-11173](https://github.com/hashicorp/vault/pull/11173)]FEATURES:* **Aerospike Storage Backend**: Add support for using Aerospike as a storage backend [[GH-10131](https://github.com/hashicorp/vault/pull/10131)]+* **Autopilot for Integrated Storage**: A set of features has been added to allow for automatic operator-friendly management of Vault servers. This is only applicable when integrated storage is in use.+* **Dead Server Cleanup**: Dead servers will periodically be cleaned up and removed from the Raft peer set, to prevent them from interfering with the quorum size and leader elections.+* **Server Health Checking**: An API has been added to track the state of servers, including their health.+* **New Server Stabilization**: When a new server is added to the cluster, there will be a waiting period where it must be healthy and stable for a certain amount of time before being promoted to a full, voting member.+* **Tokenization Secrets Engine (Enterprise)**: The Tokenization Secrets Engine is now generally available. We have added support for MySQL, key rotation, and snapshot/restore.* agent: Support for persisting the agent cache to disk [[GH-10938](https://github.com/hashicorp/vault/pull/10938)]* auth/jwt: Adds `max_age` role parameter and `auth_time` claim validation. [[GH-10919](https://github.com/hashicorp/vault/pull/10919)]+* core (enterprise): X-Vault-Index and related headers can be used by clients to manage eventual consistency.* kmip (enterprise): Use entropy augmentation to generate kmip certificates* sdk: Private key generation in the certutil package now allows custom io.Readers to be used. [[GH-10653](https://github.com/hashicorp/vault/pull/10653)]* secrets/aws: add IAM tagging support for iam_user roles [[GH-10953](https://github.com/hashicorp/vault/pull/10953)]@@ -19,6 +25,9 @@ FEATURES:* secrets/database/mssql: Add ability to customize dynamic usernames [[GH-10767](https://github.com/hashicorp/vault/pull/10767)]* secrets/database/mysql: Add ability to customize dynamic usernames [[GH-10834](https://github.com/hashicorp/vault/pull/10834)]* secrets/database/postgresql: Add ability to customize dynamic usernames [[GH-10766](https://github.com/hashicorp/vault/pull/10766)]+* secrets/db/snowflake: Added support for Snowflake to the Database Secret Engine [[GH-10603](https://github.com/hashicorp/vault/pull/10603)]+* secrets/keymgmt (enterprise): Adds beta support for distributing and managing keys in AWS KMS.+* secrets/keymgmt (enterprise): Adds general availability for distributing and managing keys in Azure Key Vault.* secrets/openldap: Added dynamic roles to OpenLDAP similar to the combined database engine [[GH-10996](https://github.com/hashicorp/vault/pull/10996)]* secrets/terraform: New secret engine for managing Terraform Cloud API tokens [[GH-10931](https://github.com/hashicorp/vault/pull/10931)]* ui: Adds check for feature flag on application, and updates namespace toolbar on login if present [[GH-10588](https://github.com/hashicorp/vault/pull/10588)]@@ -51,6 +60,8 @@ IMPROVEMENTS:* storage/raft (enterprise): Listing of peers is now allowed on DR secondarycluster nodes, as an update operation that takes in DR operation token forauthenticating the request.+* transform (enterprise): Improve FPE transformation performance+* transform (enterprise): Use transactions with batch tokenization operations for improved performance* ui: Clarify language on usage metrics page empty state [[GH-10951](https://github.com/hashicorp/vault/pull/10951)]* ui: Customize MongoDB input fields on Database Secrets Engine [[GH-10949](https://github.com/hashicorp/vault/pull/10949)]* ui: Upgrade Ember-cli from 3.8 to 3.22. [[GH-9972](https://github.com/hashicorp/vault/pull/9972)]@@ -108,6 +119,7 @@ the given key will be used to encrypt the snapshot using AWS KMS.* transform (enterprise): Fix transform configuration not handling `stores` parameter on the legacy path* transform (enterprise): Make expiration timestamps human readable* transform (enterprise): Return false for invalid tokens on the validate endpoint rather than returning an HTTP error+* ui: Add role from database connection automatically populates the database for new role [[GH-11119](https://github.com/hashicorp/vault/pull/11119)]* ui: Fix bug in Transform secret engine when a new role is added and then removed from a transformation [[GH-10417](https://github.com/hashicorp/vault/pull/10417)]* ui: Fix bug that double encodes secret route when there are spaces in the path and makes you unable to view the version history. [[GH-10596](https://github.com/hashicorp/vault/pull/10596)]* ui: Fix expected response from feature-flags endpoint [[GH-10684](https://github.com/hashicorp/vault/pull/10684)]changelog/11213.txt | 3 +++ui/app/services/namespace.js | 6 +++++-2 files changed, 8 insertions(+), 1 deletion(-)create mode 100644 changelog/11213.txt
go.sum+5 −2
@@ -425,8 +425,8 @@ github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWegithub.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=-github.com/gocql/gocql v0.0.0-20200624222514-34081eda590e h1:SroDcndcOU9BVAduPf/PXihXoR2ZYTQYLXbupbqxAyQ=-github.com/gocql/gocql v0.0.0-20200624222514-34081eda590e/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=+github.com/gocql/gocql v0.0.0-20210401103645-80ab1e13e309 h1:8MHuCGYDXh0skFrLumkCMlt9C29hxhqNx39+Haemeqw=+github.com/gocql/gocql v0.0.0-20210401103645-80ab1e13e309/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=@@ -1061,6 +1061,8 @@ github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6Sogithub.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=+github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0=+github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=github.com/rs/zerolog v1.4.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=@@ -1591,6 +1593,7 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=+gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
vault/logical_system_raft.go+9 −9
@@ -402,8 +402,8 @@ func (b *SystemBackend) handleStorageRaftSnapshotRead() framework.OperationFuncfunc (b *SystemBackend) handleStorageRaftAutopilotState() framework.OperationFunc {return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {-raftBackend, ok := b.Core.underlyingPhysical.(*raft.RaftBackend)-if !ok {+raftBackend := b.Core.getRaftBackend()+if raftBackend == nil {return logical.ErrorResponse("raft storage is not in use"), logical.ErrInvalidRequest}@@ -431,12 +431,12 @@ func (b *SystemBackend) handleStorageRaftAutopilotState() framework.OperationFunfunc (b *SystemBackend) handleStorageRaftAutopilotConfigRead() framework.OperationFunc {return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {-raftStorage, ok := b.Core.underlyingPhysical.(*raft.RaftBackend)-if !ok {+raftBackend := b.Core.getRaftBackend()+if raftBackend == nil {return logical.ErrorResponse("raft storage is not in use"), logical.ErrInvalidRequest}config := raftStorage.AutopilotConfig()+config := raftBackend.AutopilotConfig()if config == nil {return nil, nil}@@ -456,8 +456,8 @@ func (b *SystemBackend) handleStorageRaftAutopilotConfigRead() framework.Operatifunc (b *SystemBackend) handleStorageRaftAutopilotConfigUpdate() framework.OperationFunc {return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {-raftStorage, ok := b.Core.underlyingPhysical.(*raft.RaftBackend)-if !ok {+raftBackend := b.Core.getRaftBackend()+if raftBackend == nil {return logical.ErrorResponse("raft storage is not in use"), logical.ErrInvalidRequest}@@ -506,7 +506,7 @@ func (b *SystemBackend) handleStorageRaftAutopilotConfigUpdate() framework.Operapersist = true}effectiveConf := raftStorage.AutopilotConfig()+effectiveConf := raftBackend.AutopilotConfig()effectiveConf.Merge(config)if effectiveConf.CleanupDeadServers && effectiveConf.MinQuorum < 3 {@@ -525,7 +525,7 @@ func (b *SystemBackend) handleStorageRaftAutopilotConfigUpdate() framework.Opera}// Set the effectiveConfig-raftStorage.SetAutopilotConfig(effectiveConf)+raftBackend.SetAutopilotConfig(effectiveConf)return nil, nil}
website/content/api-docs/secret/pki.mdx+15 −13
@@ -1573,9 +1573,11 @@ expiration time.- `tidy_cert_store` `(bool: false)` Specifies whether to tidy up the certificatestore.- `tidy_revoked_certs` `(bool: false)` Set to true to expire all revoked and-expired certificates, removing them both from the CRL and from storage. The-CRL will be rotated if this causes any values to be removed.+- `tidy_revoked_certs` `(bool: false)` Set to true to remove all invalid and+expired certificates from storage. A revoked storage entry is considered+invalid if the entry is empty, or the value within the entry is empty. If a+certificate is removed due to expiry, the entry will also be removed from the+CRL, and the CRL will be rotated.- `safety_buffer` `(string: "")` Specifies A duration (given as an integernumber of seconds or a string; defaults to `72h`) used as a safety buffer to@@ -1605,29 +1607,29 @@ $ curl \# Cluster ScalabilityMost non-introspection operations in the PKI secrets engine require a write to-storage, and so are forwarded to the cluster's active node for execution.-This table outlines which operations can be executed on performance standbys+Most non-introspection operations in the PKI secrets engine require a write to+storage, and so are forwarded to the cluster's active node for execution.+This table outlines which operations can be executed on performance standbysand thus scale horizontally.| Path | Operations |-| --------------------------- | ------------------- |-| ca[/pem] | Read |-| cert/<em>serial-number</em> | Read |+| --------------------------- | ------------------- |+| ca[/pem] | Read |+| cert/<em>serial-number</em> | Read || cert/ca_chain | Read || config/crl | Read |-| certs | List |+| certs | List || ca_chain | Read || crl[/pem] | Read |-| crl/pem | Read |+| crl/pem | Read || issue | Update <sup>*</sup> || revoked/* | Read, List || sign | Update <sup>*</sup> || sign-verbatim | Update <sup>*</sup> |\* Only if the corresponding role has `no_store` set to true and `generate_lease`-set to false. If `generate_lease` is true the lease creation will be forwarded to-the active node; if `no_store` is false the entire request will be forwarded to+set to false. If `generate_lease` is true the lease creation will be forwarded to+the active node; if `no_store` is false the entire request will be forwarded tothe active node..circleci/config.yml | 448 +--.circleci/config/@build-release.yml | 436 +--.circleci/config/executors/@executors.yml | 8 +-changelog/11395.txt | 3 +packages-oss.lock/layers/layers.mk | 664 ++---packages-oss.lock/pkgs.yml | 3122 ++++++++++-----------packages-oss.yml | 2 +-scripts/docker/Dockerfile | 2 +-8 files changed, 2344 insertions(+), 2341 deletions(-)create mode 100644 changelog/11395.txt
go.sum+2 −2
@@ -174,8 +174,8 @@ github.com/armon/go-metrics v0.3.0/go.mod h1:zXjbSimjXTd7vOpY8B0/2LpvNvDoXBuplADgithub.com/armon/go-metrics v0.3.3/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=github.com/armon/go-metrics v0.3.4 h1:Xqf+7f2Vhl9tsqDYmXhnXInUdcrtgpRNpIA15/uldSc=github.com/armon/go-metrics v0.3.4/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=-github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e h1:h0gP0hBU6DsA5IQduhLWGOEfIUKzJS5hhXQBSgHuF/g=-github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU=+github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a h1:AP/vsCIvJZ129pdm9Ek7bH7yutN3hByqsMoNrWAxRQc=+github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU=github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
physical/cassandra/cassandra.go+17 −18
@@ -10,11 +10,10 @@ import ("strings""time""github.com/hashicorp/errwrap"-log "github.com/hashicorp/go-hclog"-metrics "github.com/armon/go-metrics""github.com/gocql/gocql"+"github.com/hashicorp/errwrap"+log "github.com/hashicorp/go-hclog""github.com/hashicorp/vault/sdk/helper/certutil""github.com/hashicorp/vault/sdk/physical")@@ -180,20 +179,18 @@ func setupCassandraTLS(conf map[string]string, cluster *gocql.ClusterConfig) errif err != nil {return err}-} else {-if pemJSONPath, ok := conf["pem_json_file"]; ok {-pemJSONData, err := ioutil.ReadFile(pemJSONPath)-if err != nil {-return errwrap.Wrapf(fmt.Sprintf("error reading json bundle from %q: {{err}}", pemJSONPath), err)-}-pemJSON, err := certutil.ParsePKIJSON([]byte(pemJSONData))-if err != nil {-return err-}-tlsConfig, err = pemJSON.GetTLSConfig(certutil.TLSClient)-if err != nil {-return err-}+} else if pemJSONPath, ok := conf["pem_json_file"]; ok {+pemJSONData, err := ioutil.ReadFile(pemJSONPath)+if err != nil {+return errwrap.Wrapf(fmt.Sprintf("error reading json bundle from %q: {{err}}", pemJSONPath), err)+}+pemJSON, err := certutil.ParsePKIJSON([]byte(pemJSONData))+if err != nil {+return err+}+tlsConfig, err = pemJSON.GetTLSConfig(certutil.TLSClient)+if err != nil {+return err}}@@ -225,7 +222,9 @@ func setupCassandraTLS(conf map[string]string, cluster *gocql.ClusterConfig) err}cluster.SslOpts = &gocql.SslOptions{-Config: tlsConfig.Clone()}+Config: tlsConfig,+EnableHostVerification: !tlsConfig.InsecureSkipVerify,+}return nil}
plugins/database/cassandra/connection_producer.go+56 −53
@@ -8,14 +8,13 @@ import ("sync""time""github.com/gocql/gocql"+dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5""github.com/hashicorp/vault/sdk/database/helper/connutil""github.com/hashicorp/vault/sdk/database/helper/dbutil""github.com/hashicorp/vault/sdk/helper/certutil""github.com/hashicorp/vault/sdk/helper/parseutil""github.com/hashicorp/vault/sdk/helper/tlsutil"-"github.com/gocql/gocql"-dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5""github.com/mitchellh/mapstructure")@@ -40,9 +39,7 @@ type cassandraConnectionProducer struct {connectTimeout time.DurationsocketKeepAlive time.Duration-certificate string-privateKey string-issuingCA string+certBundle *certutil.CertBundlerawConfig map[string]interface{}Initialized bool@@ -99,9 +96,7 @@ func (c *cassandraConnectionProducer) Initialize(ctx context.Context, req dbplugif err != nil {return fmt.Errorf("error marshaling PEM information: %w", err)}-c.certificate = certBundle.Certificate-c.privateKey = certBundle.PrivateKey-c.issuingCA = certBundle.IssuingCA+c.certBundle = certBundlec.TLS = truecase len(c.PemBundle) != 0:@@ -113,9 +108,11 @@ func (c *cassandraConnectionProducer) Initialize(ctx context.Context, req dbplugif err != nil {return fmt.Errorf("error marshaling PEM information: %w", err)}-c.certificate = certBundle.Certificate-c.privateKey = certBundle.PrivateKey-c.issuingCA = certBundle.IssuingCA+c.certBundle = certBundle+c.TLS = true+}+if c.InsecureTLS {c.TLS = true}@@ -185,49 +182,13 @@ func (c *cassandraConnectionProducer) createSession(ctx context.Context) (*gocqlclusterConfig.Timeout = c.connectTimeoutclusterConfig.SocketKeepalive = c.socketKeepAlive-if c.TLS {-var tlsConfig *tls.Config-if len(c.certificate) > 0 || len(c.issuingCA) > 0 {-if len(c.certificate) > 0 && len(c.privateKey) == 0 {-return nil, fmt.Errorf("found certificate for TLS authentication but no private key")-}certBundle := &certutil.CertBundle{}-if len(c.certificate) > 0 {-certBundle.Certificate = c.certificate-certBundle.PrivateKey = c.privateKey-}-if len(c.issuingCA) > 0 {-certBundle.IssuingCA = c.issuingCA-}-parsedCertBundle, err := certBundle.ToParsedCertBundle()-if err != nil {-return nil, fmt.Errorf("failed to parse certificate bundle: %w", err)-}-tlsConfig, err = parsedCertBundle.GetTLSConfig(certutil.TLSClient)-if err != nil || tlsConfig == nil {-return nil, fmt.Errorf("failed to get TLS configuration: tlsConfig:%#v err:%w", tlsConfig, err)-}-tlsConfig.InsecureSkipVerify = c.InsecureTLS-if c.TLSMinVersion != "" {-var ok bool-tlsConfig.MinVersion, ok = tlsutil.TLSLookup[c.TLSMinVersion]-if !ok {-return nil, fmt.Errorf("invalid 'tls_min_version' in config")-}-} else {-// MinVersion was not being set earlier. Reset it to-// zero to gracefully handle upgrades.-tlsConfig.MinVersion = 0-}-}-clusterConfig.SslOpts = &gocql.SslOptions{-Config: tlsConfig,+if c.TLS {+sslOpts, err := getSslOpts(c.certBundle, c.TLSMinVersion, c.InsecureTLS)+if err != nil {+return nil, err}+clusterConfig.SslOpts = sslOpts}if c.LocalDatacenter != "" {@@ -269,6 +230,48 @@ func (c *cassandraConnectionProducer) createSession(ctx context.Context) (*gocqlreturn session, nil}func getSslOpts(certBundle *certutil.CertBundle, minTLSVersion string, insecureSkipVerify bool) (*gocql.SslOptions, error) {+tlsConfig := &tls.Config{}+if certBundle != nil {+if certBundle.Certificate == "" && certBundle.PrivateKey != "" {+return nil, fmt.Errorf("found private key for TLS authentication but no certificate")+}+if certBundle.Certificate != "" && certBundle.PrivateKey == "" {+return nil, fmt.Errorf("found certificate for TLS authentication but no private key")+}+parsedCertBundle, err := certBundle.ToParsedCertBundle()+if err != nil {+return nil, fmt.Errorf("failed to parse certificate bundle: %w", err)+}+tlsConfig, err = parsedCertBundle.GetTLSConfig(certutil.TLSClient)+if err != nil {+return nil, fmt.Errorf("failed to get TLS configuration: tlsConfig:%#v err:%w", tlsConfig, err)+}+}+tlsConfig.InsecureSkipVerify = insecureSkipVerify+if minTLSVersion != "" {+var ok bool+tlsConfig.MinVersion, ok = tlsutil.TLSLookup[minTLSVersion]+if !ok {+return nil, fmt.Errorf("invalid 'tls_min_version' in config")+}+} else {+// MinVersion was not being set earlier. Reset it to+// zero to gracefully handle upgrades.+tlsConfig.MinVersion = 0+}+opts := &gocql.SslOptions{+Config: tlsConfig,+EnableHostVerification: !insecureSkipVerify,+}+return opts, nil+}+func (c *cassandraConnectionProducer) secretValues() map[string]string {return map[string]string{c.Password: "[password]",
vendor/github.com/hashicorp/vault-plugin-auth-jwt/path_config.go+18 −1
@@ -160,6 +160,23 @@ func (b *jwtAuthBackend) pathConfigRead(ctx context.Context, req *logical.Requesreturn nil, nil}provider, err := NewProviderConfig(ctx, config, ProviderMap())+if err != nil {+return nil, err+}+// Omit sensitive keys from provider-specific config+providerConfig := make(map[string]interface{})+if provider != nil {+for k, v := range config.ProviderConfig {+providerConfig[k] = v+}+for _, k := range provider.SensitiveKeys() {+delete(providerConfig, k)+}+}+resp := &logical.Response{Data: map[string]interface{}{"oidc_discovery_url": config.OIDCDiscoveryURL,@@ -173,7 +190,7 @@ func (b *jwtAuthBackend) pathConfigRead(ctx context.Context, req *logical.Reques"jwks_url": config.JWKSURL,"jwks_ca_pem": config.JWKSCAPEM,"bound_issuer": config.BoundIssuer,-"provider_config": config.ProviderConfig,+"provider_config": providerConfig,"namespace_in_state": config.NamespaceInState,},}
plugins/database/cassandra/connection_producer_test.go+95 −0
@@ -0,0 +1,95 @@+package cassandra+import (+"context"+"crypto/tls"+"testing"+"time"+"github.com/gocql/gocql"+"github.com/hashicorp/vault/helper/testhelpers/cassandra"+"github.com/hashicorp/vault/sdk/database/dbplugin/v5"+)+var (+insecureFileMounts = map[string]string{+"test-fixtures/no_tls/cassandra.yaml": "/etc/cassandra/cassandra.yaml",+}+secureFileMounts = map[string]string{+"test-fixtures/with_tls/cassandra.yaml": "/etc/cassandra/cassandra.yaml",+"test-fixtures/with_tls/keystore.jks": "/etc/cassandra/keystore.jks",+"test-fixtures/with_tls/.cassandra": "/root/.cassandra/",+}+)+func TestTLSConnection(t *testing.T) {+type testCase struct {+config map[string]interface{}+expectErr bool+}+tests := map[string]testCase{+"tls not specified": {+config: map[string]interface{}{},+expectErr: true,+},+"unrecognized certificate": {+config: map[string]interface{}{+"tls": "true",+},+expectErr: true,+},+"insecure TLS": {+config: map[string]interface{}{+"tls": "true",+"insecure_tls": true,+},+expectErr: false,+},+}+for name, test := range tests {+t.Run(name, func(t *testing.T) {+host, cleanup := cassandra.PrepareTestContainer(t,+cassandra.Version("3.11.9"),+cassandra.CopyFromTo(secureFileMounts),+cassandra.SslOpts(&gocql.SslOptions{+Config: &tls.Config{InsecureSkipVerify: true},+EnableHostVerification: false,+}),+)+defer cleanup()+// Set values that we don't know until the cassandra container is started+config := map[string]interface{}{+"hosts": host.ConnectionURL(),+"port": host.Port,+"username": "cassandra",+"password": "cassandra",+"protocol_version": "3",+"connect_timeout": "20s",+}+// Then add any values specified in the test config. Generally for these tests they shouldn't overlap+for k, v := range test.config {+config[k] = v+}+db := new()+initReq := dbplugin.InitializeRequest{+Config: config,+VerifyConnection: true,+}+ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)+defer cancel()+_, err := db.Initialize(ctx, initReq)+if test.expectErr && err == nil {+t.Fatalf("err expected, got nil")+}+if !test.expectErr && err != nil {+t.Fatalf("no error expected, got: %s", err)+}+})+}+}
vendor/github.com/gocql/gocql/README.md+3 −68
@@ -19,8 +19,8 @@ The following matrix shows the versions of Go and Cassandra that are tested withGo/Cassandra | 2.1.x | 2.2.x | 3.x.x-------------| -------| ------| ----------1.13 | yes | yes | yes-1.14 | yes | yes | yes+1.15 | yes | yes | yes+1.16 | yes | yes | yesGocql has been tested in production against many different versions of Cassandra. Due to limits in our CI setup we only test against the latest 3 major releases, which coincide with the official support from the Apache project.@@ -114,73 +114,7 @@ statement.Example-------```go-/* Before you execute the program, Launch `cqlsh` and execute:-create keyspace example with replication = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };-create table example.tweet(timeline text, id UUID, text text, PRIMARY KEY(id));-create index on example.tweet(timeline);-*/-package main-import (-"fmt"-"log"-"github.com/gocql/gocql"-)-func main() {-// connect to the cluster-cluster := gocql.NewCluster("192.168.1.1", "192.168.1.2", "192.168.1.3")-cluster.Keyspace = "example"-cluster.Consistency = gocql.Quorum-session, _ := cluster.CreateSession()-defer session.Close()-// insert a tweet-if err := session.Query(`INSERT INTO tweet (timeline, id, text) VALUES (?, ?, ?)`,-"me", gocql.TimeUUID(), "hello world").Exec(); err != nil {-log.Fatal(err)-}-var id gocql.UUID-var text string-/* Search for a specific set of records whose 'timeline' column matches-* the value 'me'. The secondary index that we created earlier will be-* used for optimizing the search */-if err := session.Query(`SELECT id, text FROM tweet WHERE timeline = ? LIMIT 1`,-"me").Consistency(gocql.One).Scan(&id, &text); err != nil {-log.Fatal(err)-}-fmt.Println("Tweet:", id, text)-// list all tweets-iter := session.Query(`SELECT id, text FROM tweet WHERE timeline = ?`, "me").Iter()-for iter.Scan(&id, &text) {-fmt.Println("Tweet:", id, text)-}-if err := iter.Close(); err != nil {-log.Fatal(err)-}-}-```-Authentication-```go-cluster := gocql.NewCluster("192.168.1.1", "192.168.1.2", "192.168.1.3")-cluster.Authenticator = gocql.PasswordAuthenticator{-Username: "user",-Password: "password"-}-cluster.Keyspace = "example"-cluster.Consistency = gocql.Quorum-session, _ := cluster.CreateSession()-defer session.Close()-```+See [package documentation](https://pkg.go.dev/github.com/gocql/gocql#pkg-examples).Data Binding------------
vendor/github.com/hashicorp/vault/sdk/logical/storage_view.go+1 −3
@@ -42,9 +42,7 @@ func (s *StorageView) Get(ctx context.Context, key string) (*StorageEntry, errorif entry == nil {return nil, nil}-if entry != nil {-entry.Key = s.TruncateKey(entry.Key)-}+entry.Key = s.TruncateKey(entry.Key)return &StorageEntry{Key: entry.Key,
vault/request_forwarding_rpc.go+8 −11
@@ -7,9 +7,10 @@ import ("sync/atomic""time""github.com/hashicorp/vault/sdk/helper/consts"+"github.com/hashicorp/vault/helper/forwarding""github.com/hashicorp/vault/physical/raft"-"github.com/hashicorp/vault/sdk/helper/consts""github.com/hashicorp/vault/vault/replication")@@ -83,10 +84,8 @@ func (s *forwardedRequestRPCServer) Echo(ctx context.Context, in *EchoRequest) (}if raftBackend := s.core.getRaftBackend(); raftBackend != nil {-if !s.core.isRaftHAOnly() {-reply.RaftAppliedIndex = raftBackend.AppliedIndex()-reply.RaftNodeID = raftBackend.NodeID()-}+reply.RaftAppliedIndex = raftBackend.AppliedIndex()+reply.RaftNodeID = raftBackend.NodeID()}return reply, nil@@ -114,12 +113,10 @@ func (c *forwardingClient) startHeartbeat() {}if raftBackend := c.core.getRaftBackend(); raftBackend != nil {-if !c.core.isRaftHAOnly() {-req.RaftAppliedIndex = raftBackend.AppliedIndex()-req.RaftNodeID = raftBackend.NodeID()-req.RaftTerm = raftBackend.Term()-req.RaftDesiredSuffrage = raftBackend.DesiredSuffrage()-}+req.RaftAppliedIndex = raftBackend.AppliedIndex()+req.RaftNodeID = raftBackend.NodeID()+req.RaftTerm = raftBackend.Term()+req.RaftDesiredSuffrage = raftBackend.DesiredSuffrage()}ctx, cancel := context.WithTimeout(c.echoContext, 2*time.Second)=?UTF-8?q?quest,=20it's=20not=20using=20the=20request=20cont=E2=80=A6=20(?==?UTF-8?q?#11362)?=changelog/11322.txt | 3 +++vault/request_forwarding.go | 2 +-2 files changed, 4 insertions(+), 1 deletion(-)create mode 100644 changelog/11322.txt
go.mod+1 −1
@@ -23,7 +23,7 @@ require (github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5github.com/apple/foundationdb/bindings/go v0.0.0-20190411004307-cd5c9d91fad2github.com/armon/go-metrics v0.3.4-github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e+github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0agithub.com/armon/go-radix v1.0.0github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facfgithub.com/aws/aws-sdk-go v1.37.19
More files changed — see the full commit.
References
- ADVISORYhttps://github.com/advisories/GHSA-6239-28c2-9mrm
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-38554
- WEBhttps://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166
- WEBhttps://github.com/hashicorp/vault/releases/tag/v1.6.6
- WEBhttps://github.com/hashicorp/vault/releases/tag/v1.7.4
- WEBhttps://security.gentoo.org/glsa/202207-01