Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump github.com/hashicorp/vault from 1.11.3 to 1.13.10 in /provider (#…
…343) Bumps [github.com/hashicorp/vault](https://github.com/hashicorp/vault) from 1.11.3 to 1.13.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/vault/releases">github.com/hashicorp/vault's releases</a>.</em></p> <blockquote> <h2>v1.13.10</h2> <h2>1.13.10</h2> <h3>November 09, 2023</h3> <p>SECURITY:</p> <ul> <li>core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [<a href="https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926">HSEC-2023-33</a>]</li> </ul> <p>CHANGES:</p> <ul> <li>auth/approle: Normalized error response messages when invalid credentials are provided [<a href="https://redirect.github.com/hashicorp/vault/pull/23786">GH-23786</a>]</li> <li>secrets/mongodbatlas: Update plugin to v0.9.2 [<a href="https://redirect.github.com/hashicorp/vault/pull/23849">GH-23849</a>]</li> </ul> <p>FEATURES:</p> <ul> <li>cli/snapshot: Add CLI tool to inspect Vault snapshots [<a href="https://redirect.github.com/hashicorp/vault/pull/23457">GH-23457</a>]</li> </ul> <p>IMPROVEMENTS:</p> <ul> <li>storage/etcd: etcd should only return keys when calling List() [<a href="https://redirect.github.com/hashicorp/vault/pull/23872">GH-23872</a>]</li> </ul> <p>BUG FIXES:</p> <ul> <li>api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [<a href="https://redirect.github.com/hashicorp/vault/pull/23861">GH-23861</a>]</li> <li>core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.</li> <li>core/activity: Fixes segments fragment loss due to exceeding entry record size limit [<a href="https://redirect.github.com/hashicorp/vault/pull/23781">GH-23781</a>]</li> <li>core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [<a href="https://redirect.github.com/hashicorp/vault/pull/23802">GH-23802</a>]</li> <li>core: Revert PR causing memory consumption bug [<a href="https://redirect.github.com/hashicorp/vault/pull/23986">GH-23986</a>]</li> <li>core: Skip unnecessary deriving of policies during Login MFA Check. [<a href="https://redirect.github.com/hashicorp/vault/pull/23894">GH-23894</a>]</li> <li>core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with <code>detect_deadlocks</code>. [<a href="https://redirect.github.com/hashicorp/vault/pull/23902">GH-23902</a>]</li> <li>core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [<a href="https://redirect.github.com/hashicorp/vault/pull/23874">GH-23874</a>]</li> <li>expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [<a href="https://redirect.github.com/hashicorp/vault/pull/24027">GH-24027</a>]</li> </ul> <h2>v1.13.9</h2> <h2>1.13.9</h2> <h3>October 25, 2023</h3> <p>CHANGES:</p> <ul> <li>core: Bump Go version to 1.20.10.</li> <li>replication (enterprise): Switch to non-deprecated gRPC field for resolver target host</li> </ul> <p>IMPROVEMENTS:</p> <ul> <li>api/plugins: add <code>tls-server-name</code> arg for plugin registration [<a href="https://redirect.github.com/hashicorp/vault/pull/23549">GH-23549</a>]</li> <li>core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [<a href="https://redirect.github.com/hashicorp/vault/pull/22567">GH-22567</a>]</li> </ul> <p>BUG FIXES:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/vault/blob/main/CHANGELOG.md">github.com/hashicorp/vault's changelog</a>.</em></p> <blockquote> <h2>1.13.10</h2> <h3>November 09, 2023</h3> <p>SECURITY:</p> <ul> <li>core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [<a href="https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926">HSEC-2023-33</a>]</li> </ul> <p>CHANGES:</p> <ul> <li>auth/approle: Normalized error response messages when invalid credentials are provided [<a href="https://redirect.github.com/hashicorp/vault/pull/23786">GH-23786</a>]</li> <li>secrets/mongodbatlas: Update plugin to v0.9.2 [<a href="https://redirect.github.com/hashicorp/vault/pull/23849">GH-23849</a>]</li> </ul> <p>FEATURES:</p> <ul> <li>cli/snapshot: Add CLI tool to inspect Vault snapshots [<a href="https://redirect.github.com/hashicorp/vault/pull/23457">GH-23457</a>]</li> </ul> <p>IMPROVEMENTS:</p> <ul> <li>storage/etcd: etcd should only return keys when calling List() [<a href="https://redirect.github.com/hashicorp/vault/pull/23872">GH-23872</a>]</li> </ul> <p>BUG FIXES:</p> <ul> <li>api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured on the request. [<a href="https://redirect.github.com/hashicorp/vault/pull/23861">GH-23861</a>]</li> <li>core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.</li> <li>core/activity: Fixes segments fragment loss due to exceeding entry record size limit [<a href="https://redirect.github.com/hashicorp/vault/pull/23781">GH-23781</a>]</li> <li>core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [<a href="https://redirect.github.com/hashicorp/vault/pull/23802">GH-23802</a>]</li> <li>core: Revert PR causing memory consumption bug [<a href="https://redirect.github.com/hashicorp/vault/pull/23986">GH-23986</a>]</li> <li>core: Skip unnecessary deriving of policies during Login MFA Check. [<a href="https://redirect.github.com/hashicorp/vault/pull/23894">GH-23894</a>]</li> <li>core: fix bug where deadlock detection was always on for expiration and quotas. These can now be configured individually with <code>detect_deadlocks</code>. [<a href="https://redirect.github.com/hashicorp/vault/pull/23902">GH-23902</a>]</li> <li>core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [<a href="https://redirect.github.com/hashicorp/vault/pull/23874">GH-23874</a>]</li> <li>expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [<a href="https://redirect.github.com/hashicorp/vault/pull/24027">GH-24027</a>]</li> </ul> <h2>1.13.9</h2> <h3>October 25, 2023</h3> <p>CHANGES:</p> <ul> <li>core: Bump Go version to 1.20.10.</li> <li>replication (enterprise): Switch to non-deprecated gRPC field for resolver target host</li> </ul> <p>IMPROVEMENTS:</p> <ul> <li>api/plugins: add <code>tls-server-name</code> arg for plugin registration [<a href="https://redirect.github.com/hashicorp/vault/pull/23549">GH-23549</a>]</li> <li>core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [<a href="https://redirect.github.com/hashicorp/vault/pull/22567">GH-22567</a>]</li> </ul> <p>BUG FIXES:</p> <ul> <li>command/server: Fix bug with sigusr2 where pprof files were not closed correctly [<a href="https://redirect.github.com/hashicorp/vault/pull/23636">GH-23636</a>]</li> <li>events: Ignore sending context to give more time for events to send [<a href="https://redirect.github.com/hashicorp/vault/pull/23500">GH-23500</a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/vault/commit/39680359a1c5d78d05679ac94fa4f0944d442581"><code>3968035</code></a> backport of commit 7ec3867eea2ad3c405f15f9ab5447618685739cf (<a href="https://redirect.github.com/hashicorp/vault/issues/24030">#24030</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/e273d02e201d918c2d8eded51c60e8372fe5823d"><code>e273d02</code></a> backport of commit b19562db9a8c1b65ea660ed0d51aaf9498a9887d (<a href="https://redirect.github.com/hashicorp/vault/issues/24024">#24024</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/ac3bfb4472478a9fe32aa9487763e0ac46cab0e8"><code>ac3bfb4</code></a> docs: add workaround to known issue loading missing policies from other names...</li> <li><a href="https://github.com/hashicorp/vault/commit/e8ebe6b5651705359111cc3f7aefedd203fde959"><code>e8ebe6b</code></a> Revert "Automatically track subloggers in allLoggers (<a href="https://redirect.github.com/hashicorp/vault/issues/22038">#22038</a>)" (<a href="https://redirect.github.com/hashicorp/vault/issues/24004">#24004</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/0b0b730710ed455e7d721a603c73efcfb5a07263"><code>0b0b730</code></a> Add known issue for sublogger memory leak (<a href="https://redirect.github.com/hashicorp/vault/issues/23977">#23977</a>) (<a href="https://redirect.github.com/hashicorp/vault/issues/24007">#24007</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/535ca5f0d11a873cf424aceaeab6df5785e045aa"><code>535ca5f</code></a> backport of commit 9538c6e59b69033b7d0441e6eaf6260c0cbbee6d (<a href="https://redirect.github.com/hashicorp/vault/issues/23996">#23996</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/9ec145bd55c9f4dd1ff3d5d610d57af898739273"><code>9ec145b</code></a> backport of commit d93a13a7e3f5c2ef9293e3ef0bc84e8823dfe560 (<a href="https://redirect.github.com/hashicorp/vault/issues/23989">#23989</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/fa61a0be085af7b194bc7ad46bd7ff05471e12a3"><code>fa61a0b</code></a> replace nytimes/gziphandler with klauspost/compress/gzhttp (<a href="https://redirect.github.com/hashicorp/vault/issues/23898">#23898</a>) (<a href="https://redirect.github.com/hashicorp/vault/issues/23961">#23961</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/2f510ccb8a83584aed2de0f49c871693fbef9000"><code>2f510cc</code></a> backport of commit 750ab337eaa0b049d9cf1535c00e860129e5e9a0 (<a href="https://redirect.github.com/hashicorp/vault/issues/23954">#23954</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/89c37a738eb1fb634328134ffaf1412467ad9a57"><code>89c37a7</code></a> Backport of [DOCS] Link to compliance page for vault instead of a pdf into re...</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/vault/compare/v1.11.3...v1.13.10">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/vault&package-manager=go_modules&previous-version=1.11.3&new-version=1.13.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pulumi/pulumi-vault/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information