From fe5c49edb5d98f4a652a68922fe677c0992fcd2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Mon, 10 Aug 2026 19:24:43 +0200 Subject: [PATCH] v1.37.1: update to vaultwarden 1.37.1 - Bump image to docker.io/vaultwarden/server:1.37.1 (new digest) - Security fixes upstream: SSRF via icon endpoint, cross-org cipher access, org policy bypass, WebSocket DDoS; invite fixes in 1.37.1 - Sync vaultwarden.cfg with upstream 1.37.1 .env.template --- vaultwarden-container.spec | 10 ++++++++-- vaultwarden.cfg | 25 +++++++++++++++++++++---- vaultwarden.container | 2 +- 3 files changed, 30 insertions(+), 7 deletions(-) diff --git a/vaultwarden-container.spec b/vaultwarden-container.spec index 8bb5b23..8fc5d6e 100644 --- a/vaultwarden-container.spec +++ b/vaultwarden-container.spec @@ -1,6 +1,6 @@ Name: vaultwarden-container -Version: 1.36.0 -Release: 2%{?dist} +Version: 1.37.1 +Release: 1%{?dist} Summary: Vaultwarden - Bitwarden compatible server (container) License: AGPL-3.0 Group: System Environment/Base @@ -78,6 +78,12 @@ fi %dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data %changelog +* Mon Aug 10 2026 Zoran Pericic - 1.37.1-1 +- Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org + cipher access, org policy bypass, WebSocket DDoS; invite fixes) +- Sync vaultwarden.cfg with the 1.37.1 template (IP_HEADER_TRUSTED_PROXIES, + UNAUTHENTICATED_RATELIMIT_*, sqlite:// DATABASE_URL scheme) + * Mon Jul 13 2026 Zoran Pericic - 1.36.0-2 - Match native vaultwarden layout: data in /var/lib/vaultwarden/data - Use /var/lib/vaultwarden as service HOME (rootless podman storage); diff --git a/vaultwarden.cfg b/vaultwarden.cfg index 05b51d7..42d9df1 100644 --- a/vaultwarden.cfg +++ b/vaultwarden.cfg @@ -50,10 +50,11 @@ ######################### ## Database URL -## When using SQLite, this is the path to the DB file, and it defaults to -## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this -## must be set to a local sqlite3 file path. -# DATABASE_URL=data/db.sqlite3 +## When using SQLite, this should use the sqlite:// scheme followed by the path +## to the DB file. It defaults to sqlite://%DATA_FOLDER%/db.sqlite3. +## Bare paths without the sqlite:// scheme are supported for backwards compatibility, +## but only if the database file already exists. +# DATABASE_URL=sqlite://data/db.sqlite3 ## When using MySQL, specify an appropriate connection URI. ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html # DATABASE_URL=mysql://user:password@host[:port]/database_name @@ -323,6 +324,14 @@ ## Set to the string "none" (without quotes), to disable any headers and just use the remote IP # IP_HEADER=X-Real-IP +## Which addresses the header above is accepted from, defaults to "local". +## Anyone able to reach Vaultwarden can set the header, and the client IP is used for the login and +## admin rate limits, so it is only trusted when the request comes from a proxy listed here. +## "local" accepts it from any non global address, which covers a reverse proxy running on the same +## host or container network. Use "all" to accept it from anywhere, or list the addresses of your +## proxy as IPs and CIDR ranges if it connects from a public address. +# IP_HEADER_TRUSTED_PROXIES=local + ## Icon service ## The predefined icon services are: internal, bitwarden, duckduckgo, google. ## To specify a custom icon service, set a URL template with exactly one instance of `{}`, @@ -377,6 +386,7 @@ ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1) ## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0) ## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0) +## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0) ## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) ## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) ## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0) @@ -459,6 +469,13 @@ ## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2. # LOGIN_RATELIMIT_MAX_BURST=10 +## Number of seconds, on average, between requests from the same IP address to one of the rate limited +## unauthenticated endpoints, like the password hint, the account recovery mails or accessing a Send. +# UNAUTHENTICATED_RATELIMIT_SECONDS=60 +## Allow a burst of requests of up to this size, while maintaining the average indicated by `UNAUTHENTICATED_RATELIMIT_SECONDS`. +## This budget is shared between all of those endpoints, so it is more lenient than the login one. +# UNAUTHENTICATED_RATELIMIT_MAX_BURST=50 + ## BETA FEATURE: Groups ## Controls whether group support is enabled for organizations ## This setting applies to organizations. diff --git a/vaultwarden.container b/vaultwarden.container index 3bf23c1..f315c75 100644 --- a/vaultwarden.container +++ b/vaultwarden.container @@ -3,7 +3,7 @@ Description=Vaultwarden - Bitwarden compatible server [Container] ContainerName=vaultwarden -Image=docker.io/vaultwarden/server:1.36.0@sha256:d626d04934cd1192ad8ced1adb975099fca78cec33ab467d2d3c923cde7f3b0c +Image=docker.io/vaultwarden/server:1.37.1@sha256:ebdfe70701c60ac0c28c697e787cea767d7972940b786037b29fe0d507f821e8 EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg PublishPort=127.0.0.1:8000:80 Volume=/var/lib/vaultwarden/data:/data:Z