luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

changelog++

This commit is contained in:
Jeff Mitchell 2018-06-06 10:42:58 -04:00
parent 1f3cd66950
commit f1684cef2d
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
CHANGELOG.md
View File

@ -13,11 +13,13 @@ SECURITY:
lease-less tokens can no longer be used (unless they are root tokens that
never had an expiration to begin with).
* Convergent Encryption: The version 2 algorithm used in `transit`'s
convergent encryption feature is susceptible to offline chosen plaintext
attacks. As a result, we are introducing a version 3 algorithm that
mitigates this. If you are currently using convergent encryption, we
recommend upgrading, rotating your encryption key (the new key version will
use the new algorithm), and rewrapping your data.
convergent encryption feature is susceptible to offline
plaintext-confirmation attacks. As a result, we are introducing a version 3
algorithm that mitigates this. If you are currently using convergent
encryption, we recommend upgrading, rotating your encryption key (the new
key version will use the new algorithm), and rewrapping your data (the
`rewrap` endpoint can be used to allow a relatively non-privileged user to
perform the rewrapping while never divulging the plaintext).
* AppRole case-sensitive role name secret-id leaking: When using a mixed-case
role name via AppRole, deleting a secret-id via accessor or other operations
could end up leaving the secret-id behind and valid but without an accessor.