v1.37.4: update to vaultwarden 1.37.4 (security)
Seven upstream advisories fixed, one High (GHSA-69q9-v8p6-xvx3, org member revocation). Also picks up 1.37.2 (clients 2026.8.0+) and 1.37.3 (2FA token revocation, prelogin rate limiting). Replace vaultwarden.cfg with the upstream 1.37.4 template.
This commit is contained in:
zpericic committed
1 parent
fe5c49edb5
commit
24516c8df2
3 files changed
+36
-24
No files matched your search
@@ -1,5 +1,5 @@
|
||||
Name: vaultwarden-container
|
||||
Version: 1.37.1
|
||||
Version: 1.37.4
|
||||
Release: 1%{?dist}
|
||||
Summary: Vaultwarden - Bitwarden compatible server (container)
|
||||
License: AGPL-3.0
|
||||
@@ -78,6 +78,18 @@ fi
|
||||
%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data
|
||||
|
||||
%changelog
|
||||
* Sat Oct 24 2026 Zoran Pericic <zpericic@netst.org> - 1.37.4-1
|
||||
- Update to 1.37.4 (security fixes: GHSA-69q9-v8p6-xvx3 org member
|
||||
revocation [High]; GHSA-7jg8-8m5x-6j9r two-factor auth, GHSA-v576-3wvq-xh3c
|
||||
org invitations, GHSA-q5x6-grh5-fqgc attachments, GHSA-64mc-4p6f-r7x9 org
|
||||
event logs, GHSA-7ccc-c43j-4p36 cipher sharing [Medium];
|
||||
GHSA-qwx4-wcv4-mpcv org API key [Low])
|
||||
- Includes 1.37.2 (support for clients 2026.8.0+) and 1.37.3 (2FA remember
|
||||
token revocation, prelogin/auth-request rate limiting, admin 2FA reset)
|
||||
- Replace vaultwarden.cfg with the upstream 1.37.4 template
|
||||
(CLIENT_SUPPRESS_ONBOARDING, SSO_SIGNUPS_ALLOWED, DUO_USE_IFRAME removed,
|
||||
updated feature flag list, X-Forwarded-For now uses rightmost untrusted IP)
|
||||
|
||||
* Mon Aug 10 2026 Zoran Pericic <zpericic@netst.org> - 1.37.1-1
|
||||
- Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org
|
||||
cipher access, org policy bypass, WebSocket DDoS; invite fixes)
|
||||
@@ -92,5 +104,5 @@ fi
|
||||
- Sync vaultwarden.cfg with the native 1.36.0 template
|
||||
- Add Conflicts: vaultwarden
|
||||
|
||||
* Tue May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
|
||||
* Wed May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
|
||||
- Initial package
|
||||
+21
-21
@@ -23,7 +23,7 @@
|
||||
## When using an external location, make sure to set TMP_FOLDER,
|
||||
## TEMPLATES_FOLDER, and DATABASE_URL to local paths and/or a remote database
|
||||
## location.
|
||||
# DATA_FOLDER=/var/lib/vaultwarden
|
||||
# DATA_FOLDER=data
|
||||
|
||||
## Individual folders, these override %DATA_FOLDER%
|
||||
# RSA_KEY_FILENAME=data/rsa_key
|
||||
@@ -42,7 +42,7 @@
|
||||
# RELOAD_TEMPLATES=false
|
||||
|
||||
## Web vault settings
|
||||
# WEB_VAULT_FOLDER=/usr/share/vaultwarden-web
|
||||
# WEB_VAULT_FOLDER=web-vault/
|
||||
# WEB_VAULT_ENABLED=true
|
||||
|
||||
#########################
|
||||
@@ -180,7 +180,7 @@
|
||||
## Defaults to every minute. Set blank to disable this job.
|
||||
# AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
|
||||
##
|
||||
## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
|
||||
## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
|
||||
## Defaults to every minute. Set blank to disable this job.
|
||||
# DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
|
||||
#
|
||||
@@ -316,6 +316,14 @@
|
||||
## unauthenticated access to potentially sensitive data.
|
||||
# SHOW_PASSWORD_HINT=false
|
||||
|
||||
#########################
|
||||
### Client settings ###
|
||||
#########################
|
||||
|
||||
## Control whether clients onboarding interstitials are suppressed
|
||||
## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
|
||||
# CLIENT_SUPPRESS_ONBOARDING=false
|
||||
|
||||
#########################
|
||||
### Advanced settings ###
|
||||
#########################
|
||||
@@ -330,6 +338,8 @@
|
||||
## "local" accepts it from any non global address, which covers a reverse proxy running on the same
|
||||
## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
|
||||
## proxy as IPs and CIDR ranges if it connects from a public address.
|
||||
## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
|
||||
## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
|
||||
# IP_HEADER_TRUSTED_PROXIES=local
|
||||
|
||||
## Icon service
|
||||
@@ -382,21 +392,13 @@
|
||||
##
|
||||
## The following flags are available:
|
||||
## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
|
||||
## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
|
||||
## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
|
||||
## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
|
||||
## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
|
||||
## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
|
||||
## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
|
||||
## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
|
||||
## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
|
||||
## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
|
||||
## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
|
||||
## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
|
||||
## - "pm-30529-webauthn-related-origins":
|
||||
## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
|
||||
## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
|
||||
## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
|
||||
## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
|
||||
## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
|
||||
## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
|
||||
## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
|
||||
## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
|
||||
# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
|
||||
|
||||
## Require new device emails. When a user logs in an email is required to be sent.
|
||||
@@ -510,6 +512,9 @@
|
||||
## Prevent users from logging in directly without going through SSO
|
||||
# SSO_ONLY=false
|
||||
|
||||
## Allow SSO flow to create account. You probably want to disable it when using a public provider.
|
||||
# SSO_SIGNUPS_ALLOWED=true
|
||||
|
||||
## On SSO Signup if a user with a matching email already exists make the association
|
||||
# SSO_SIGNUPS_MATCH_EMAIL=true
|
||||
|
||||
@@ -572,11 +577,6 @@
|
||||
# DUO_HOST=<API Hostname>
|
||||
## After that, you should be able to follow the rest of the guide linked above,
|
||||
## ignoring the fields that ask for the values that you already configured beforehand.
|
||||
##
|
||||
## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
|
||||
## Duo no longer supports this, but it still works for some integrations.
|
||||
## If you aren't sure, leave this alone.
|
||||
# DUO_USE_IFRAME=false
|
||||
|
||||
## Email 2FA settings
|
||||
## Email token size
|
||||
|
||||
@@ -3,7 +3,7 @@ Description=Vaultwarden - Bitwarden compatible server
|
||||
|
||||
[Container]
|
||||
ContainerName=vaultwarden
|
||||
Image=docker.io/vaultwarden/server:1.37.1@sha256:ebdfe70701c60ac0c28c697e787cea767d7972940b786037b29fe0d507f821e8
|
||||
Image=docker.io/vaultwarden/server:1.37.4@sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055
|
||||
EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg
|
||||
PublishPort=127.0.0.1:8000:80
|
||||
Volume=/var/lib/vaultwarden/data:/data:Z
|
||||
|
||||
Reference in new issue
Block a user