OpenBao 2.0.0 release notes

2.0.3

Release date: November 15, 2024

warning

OpenBao's 2.0.3 Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

SECURITY

• core/identity: fix root namespace privilege escalation via entity modification. HCSEC-2024-21 / CVE-2024-9180. [GH-695]
• raft: Fix memory exhaustion when processing raft cluster join requests; results in longer challenge/answers. HCSEC-2024-26 / CVE-2024-8185. [GH-690]

CHANGES

• command/debug: Replace mholt/archiver with standard library utils. This may change file permissions but does not affect archive layout. [GH-611]

IMPROVEMENTS

• core: Update to Go 1.22.9. [GH-725]
• core: Upgrade RHEL UBI container image to 9.5. [GH-701]

BUG FIXES

• release: remove changelog/ directory from binary release tarballs [GH-641]

2.0.2

Release date: October 5, 2024

warning

OpenBao's 2.0.2 Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

SECURITY

• secrets/ssh: Deny globally valid certificate issuance without valid_principals or allow_empty_principals override. HCSEC-2024-20 / CVE-2024-7594. (potentially breaking) [GH-561]

IMPROVEMENTS

• docker: add /bin/vault symlink to docker images [GH-548]

BUG FIXES

• api/output_string: Change vault reference to bao. [GH-511]
• core: Fix server panic on AppRole login requests with invalid parameter typing [GH-512]
• secrets/pki: Fix ACME HTTP-01 challenge validation with IPv6 addresses [GH-559]
• serviceregistration/k8s: Fix compatibility with legacy VAULT_-prefixed environment variables. [GH-527]

2.0.1

Release date: September 3, 2024

warning

OpenBao's 2.0.1 Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

CHANGES

• serviceregistration/kubernetes: labels use openbao as prefix instead of vault. [GH-416]

IMPROVEMENTS

• core: Update Go to 1.22.6 [GH-504]

BUG FIXES

• cli: Always pass BAO_ADDR to the token helper, so the token helper can know the address even if it was provided through the -address flag. For compatibility we also set VAULT_ADDR. [GH-348]
• docker: fix collision between the cluster address and local JSON configuration sharing the same variable within the docker-entrypoint script [GH-446]
• secrets/pki: Fix handling of reusing existing Ed25519 keys [GH-461]

2.0.0

Release date: July 16, 2024

warning

OpenBao's 2.0.0 GA Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

SECURITY

• auth/cert: compare full bytes of trusted leaf certificates with incoming client certificates to prevent trusting certs with the same serial number but not the same public/private key. [GH-173]

CHANGES

• added other registries for docker images [GH-269]

• core: Bump Go version to 1.22.0. [GH-120]

• core: OpenBao version 2.0.0-alpha20240329.

  core: Retracted all prior Vault versions.

  api: Retracted all prior Vault versions.

  sdk: Retracted all prior Vault versions. [GH-238]

• core: Remove mlock functionality from OpenBao and make the "disable_mlock" config option obsolete. [GH-363]

• secret/transit: Remove ability to use v1 and v2 Transit convergent encryption keys migrated from Vault v0.6.2 or earlier. [GH-85]

FEATURES

• Paginated Lists: Allow plugins to support pagination on LIST requests, reducing server and client burden by limiting large responses. This uses optional after and limit parameters for clients to control the size of responses with a relative indexing into result entry sets. [GH-170]

IMPROVEMENTS

• auth: Add token_strictly_bind_ip to support strictly binding issued token to login request's IP address. [GH-202]
• cli: Expand handling of -non-interactive to prevent reading from stdin. [GH-221]
• sdk/helper/shamir: Use CS-PRNG for shuffling X coordinates; do not rely on math/rand. [GH-210]
• sdk/helper/shamir: move Shamir's code into public SDK namespace to encourage external reuse [GH-181]
• secret/pki: Add Delta CRL Distribution Point to AIA URLs, allowing AIA-aware clients to find Delta CRLs dynamically. [GH-215]
• secret/pki: Add support for KeyUsage, ExtKeyUsage when issuing CA certificates, allowing compliance with CA/BF guidelines (e.g., with GCP Load Balancers). [GH-76]
• secret/pki: Add support for basicConstraints x509 extension when issuing certificates with sign-verbatim. [GH-201]
• secret/pki: Allow pki/issue/:role with key_type=any roles, via explicit key_type and key_bits request parameters. [GH-209]
• secret/transit: Add support for XChaCha20-Poly1305 keys, preventing nonce-reuse without key rotation. [GH-36]
• secret/transit: Allow choosing export key format, specifying format=der or format=pem for consistent PKIX encoded public keys. [GH-212]
• secret/transit: Allow soft deletion of keys, preventing their use and rotation but retaining key material until restored or fully deleted. [GH-211]
• secrets/pki: Remove Vault Enterprise-only cross-cluster, unified CRL stubs (breaking). [GH-365]
• ui: The latest versions of Chrome do not automatically redirect back to an Android app after multiple redirects during an OIDC authentication flow. A link was added to allow the user to manually redirect back to the app. [GH-184]

BUG FIXES

• cli/login: Avoid calling the token helper in get mode. [GH-313]
• core/pluings: Fix compatibility when running pre-built Vault plugins. [GH-321]
• core: re-introduce Server Side Consistent Tokens (SSCTs) from upstream, defaulting to disabled [GH-298]
• packaging: fix systemd service to refer to /etc/openbao/env for environment variables [GH-275]
• physical/raft: fix ListPage calls when after=. resulting in an empty list [GH-294]
• secret/pki: Use user-submitted ordering for SANs, fixing issues where automatic ordering causes parse failures in some browsers. [GH-50]
• secret/rabbitmq: Fix role reading causing audit log panic when vhost_topics are set. [GH-224]
• secret/transit: Allow use of generated destination wrapping keys rather than strictly requiring exported keys. [GH-211]

2.0.0-beta20240618

Release date: June 18, 2024

warning

OpenBao's Beta Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

CHANGES

• added other registries for docker images [GH-269]

BUG FIXES

• cli/login: Avoid calling the token helper in get mode. [GH-313]
• core/pluings: Fix compatibility when running pre-built Vault plugins. [GH-321]
• core: re-introduce Server Side Consistent Tokens (SSCTs) from upstream, defaulting to disabled [GH-298]
• packaging: fix systemd service to refer to /etc/openbao/env for environment variables [GH-275]
• physical/raft: fix ListPage calls when after=. resulting in an empty list [GH-294]

2.0.0-alpha20240329

Release date: March 29, 2024

warning

OpenBao's Alpha Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.

SECURITY

• auth/cert: compare full bytes of trusted leaf certificates with incoming client certificates to prevent trusting certs with the same serial number but not the same public/private key. [GH-173]

CHANGES

• core: Bump Go version to 1.22.0. [GH-120]
• core: OpenBao version 2.0.0-alpha20240329. core: Retracted all prior Vault versions. api: Retracted all prior Vault versions. sdk: Retracted all prior Vault versions. [GH-238]
• secret/transit: Remove ability to use v1 and v2 Transit convergent encryption keys migrated from Vault v0.6.2 or earlier. [GH-85]

FEATURES

• Paginated Lists: Allow plugins to support pagination on LIST requests, reducing server and client burden by limiting large responses. This uses optional after and limit parameters for clients to control the size of responses with a relative indexing into result entry sets. [GH-170]

IMPROVEMENTS

• auth: Add token_strictly_bind_ip to support strictly binding issued token to login request's IP address. [GH-202]
• cli: Expand handling of -non-interactive to prevent reading from stdin. [GH-221]
• sdk/helper/shamir: Use CS-PRNG for shuffling X coordinates; do not rely on math/rand. [GH-210]
• sdk/helper/shamir: move Shamir's code into public SDK namespace to encourage external reuse [GH-181]
• secret/pki: Add Delta CRL Distribution Point to AIA URLs, allowing AIA-aware clients to find Delta CRLs dynamically. [GH-215]
• secret/pki: Add support for KeyUsage, ExtKeyUsage when issuing CA certificates, allowing compliance with CA/BF guidelines (e.g., with GCP Load Balancers). [GH-76]
• secret/pki: Add support for basicConstraints x509 extension when issuing certificates with sign-verbatim. [GH-201]
• secret/pki: Allow pki/issue/:role with key_type=any roles, via explicit key_type and key_bits request parameters. [GH-209]
• secret/transit: Add support for XChaCha20-Poly1305 keys, preventing nonce-reuse without key rotation. [GH-36]
• secret/transit: Allow choosing export key format, specifying format=der or format=pem for consistent PKIX encoded public keys. [GH-212]
• secret/transit: Allow soft deletion of keys, preventing their use and rotation but retaining key material until restored or fully deleted. [GH-211]
• ui: The latest versions of Chrome do not automatically redirect back to an Android app after multiple redirects during an OIDC authentication flow. A link was added to allow the user to manually redirect back to the app. [GH-184]

BUG FIXES

• secret/pki: Use user-submitted ordering for SANs, fixing issues where automatic ordering causes parse failures in some browsers. [GH-50]
• secret/rabbitmq: Fix role reading causing audit log panic when vhost_topics are set. [GH-224]
• secret/transit: Allow use of generated destination wrapping keys rather than strictly requiring exported keys. [GH-211]