From 24516c8df22fc142a5b30904d7b518d737da41ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Sat, 24 Oct 2026 19:53:53 +0200 Subject: [PATCH] v1.37.4: update to vaultwarden 1.37.4 (security) Seven upstream advisories fixed, one High (GHSA-69q9-v8p6-xvx3, org member revocation). Also picks up 1.37.2 (clients 2026.8.0+) and 1.37.3 (2FA token revocation, prelogin rate limiting). Replace vaultwarden.cfg with the upstream 1.37.4 template. --- vaultwarden-container.spec | 16 +++++++++++++-- vaultwarden.cfg | 42 +++++++++++++++++++------------------- vaultwarden.container | 2 +- 3 files changed, 36 insertions(+), 24 deletions(-) diff --git a/vaultwarden-container.spec b/vaultwarden-container.spec index 8fc5d6e..80f6d71 100644 --- a/vaultwarden-container.spec +++ b/vaultwarden-container.spec @@ -1,5 +1,5 @@ Name: vaultwarden-container -Version: 1.37.1 +Version: 1.37.4 Release: 1%{?dist} Summary: Vaultwarden - Bitwarden compatible server (container) License: AGPL-3.0 @@ -78,6 +78,18 @@ fi %dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data %changelog +* Sat Oct 24 2026 Zoran Pericic - 1.37.4-1 +- Update to 1.37.4 (security fixes: GHSA-69q9-v8p6-xvx3 org member + revocation [High]; GHSA-7jg8-8m5x-6j9r two-factor auth, GHSA-v576-3wvq-xh3c + org invitations, GHSA-q5x6-grh5-fqgc attachments, GHSA-64mc-4p6f-r7x9 org + event logs, GHSA-7ccc-c43j-4p36 cipher sharing [Medium]; + GHSA-qwx4-wcv4-mpcv org API key [Low]) +- Includes 1.37.2 (support for clients 2026.8.0+) and 1.37.3 (2FA remember + token revocation, prelogin/auth-request rate limiting, admin 2FA reset) +- Replace vaultwarden.cfg with the upstream 1.37.4 template + (CLIENT_SUPPRESS_ONBOARDING, SSO_SIGNUPS_ALLOWED, DUO_USE_IFRAME removed, + updated feature flag list, X-Forwarded-For now uses rightmost untrusted IP) + * Mon Aug 10 2026 Zoran Pericic - 1.37.1-1 - Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org cipher access, org policy bypass, WebSocket DDoS; invite fixes) @@ -92,5 +104,5 @@ fi - Sync vaultwarden.cfg with the native 1.36.0 template - Add Conflicts: vaultwarden -* Tue May 06 2026 Zoran Pericic - 1.36.0-1 +* Wed May 06 2026 Zoran Pericic - 1.36.0-1 - Initial package diff --git a/vaultwarden.cfg b/vaultwarden.cfg index 42d9df1..f34ea24 100644 --- a/vaultwarden.cfg +++ b/vaultwarden.cfg @@ -23,7 +23,7 @@ ## When using an external location, make sure to set TMP_FOLDER, ## TEMPLATES_FOLDER, and DATABASE_URL to local paths and/or a remote database ## location. -# DATA_FOLDER=/var/lib/vaultwarden +# DATA_FOLDER=data ## Individual folders, these override %DATA_FOLDER% # RSA_KEY_FILENAME=data/rsa_key @@ -42,7 +42,7 @@ # RELOAD_TEMPLATES=false ## Web vault settings -# WEB_VAULT_FOLDER=/usr/share/vaultwarden-web +# WEB_VAULT_FOLDER=web-vault/ # WEB_VAULT_ENABLED=true ######################### @@ -180,7 +180,7 @@ ## Defaults to every minute. Set blank to disable this job. # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *" ## -## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt. +## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled. ## Defaults to every minute. Set blank to disable this job. # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *" # @@ -316,6 +316,14 @@ ## unauthenticated access to potentially sensitive data. # SHOW_PASSWORD_HINT=false +######################### +### Client settings ### +######################### + +## Control whether clients onboarding interstitials are suppressed +## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals) +# CLIENT_SUPPRESS_ONBOARDING=false + ######################### ### Advanced settings ### ######################### @@ -330,6 +338,8 @@ ## "local" accepts it from any non global address, which covers a reverse proxy running on the same ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your ## proxy as IPs and CIDR ranges if it connects from a public address. +## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of +## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them. # IP_HEADER_TRUSTED_PROXIES=local ## Icon service @@ -382,21 +392,13 @@ ## ## The following flags are available: ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0) -## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0) +## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0) ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1) -## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0) -## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0) -## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0) -## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) -## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) -## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0) -## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2) -## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2) ## - "pm-30529-webauthn-related-origins": -## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0) +## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0) +## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1) +## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0) +## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0) # EXPERIMENTAL_CLIENT_FEATURE_FLAGS= ## Require new device emails. When a user logs in an email is required to be sent. @@ -510,6 +512,9 @@ ## Prevent users from logging in directly without going through SSO # SSO_ONLY=false +## Allow SSO flow to create account. You probably want to disable it when using a public provider. +# SSO_SIGNUPS_ALLOWED=true + ## On SSO Signup if a user with a matching email already exists make the association # SSO_SIGNUPS_MATCH_EMAIL=true @@ -572,11 +577,6 @@ # DUO_HOST= ## After that, you should be able to follow the rest of the guide linked above, ## ignoring the fields that ask for the values that you already configured beforehand. -## -## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'. -## Duo no longer supports this, but it still works for some integrations. -## If you aren't sure, leave this alone. -# DUO_USE_IFRAME=false ## Email 2FA settings ## Email token size diff --git a/vaultwarden.container b/vaultwarden.container index f315c75..81abba6 100644 --- a/vaultwarden.container +++ b/vaultwarden.container @@ -3,7 +3,7 @@ Description=Vaultwarden - Bitwarden compatible server [Container] ContainerName=vaultwarden -Image=docker.io/vaultwarden/server:1.37.1@sha256:ebdfe70701c60ac0c28c697e787cea767d7972940b786037b29fe0d507f821e8 +Image=docker.io/vaultwarden/server:1.37.4@sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055 EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg PublishPort=127.0.0.1:8000:80 Volume=/var/lib/vaultwarden/data:/data:Z