openbao

v2.5.5 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 1mo Secrets & Credentials

✓ No known CVEs patched

This release patches 4 known CVEs

Topics

go secrets-management security

Affected surfaces

auth rbac

Summary

AI summary

Security fixes in auth/ldap, secrets/ldap, core/leases, and core/namespaces plus HA bug fixes.

Full changelog

auth/ldap: Prevent unlikely post-bind LDAP injection via bind DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
secrets/ldap: Prevent potential LDAP injection with unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9. [GH-3306]
secrets/transit: Prevent server crash due to unlock of unlocked mutex for RSA keys created with derived=true. GHSA-8w8f-r2xv-4q4j. [GH-3309]
core/leases: Fix unauthorized cross-namespace lease revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2. [GH-3307]
core/namespaces: Fix namespace path canonicalization of "root" enabling unauthorized operations on the parent namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]

core/ha: Return to read-enabled standby mode instead of read-disabled standby mode after stepping down from active mode when standby reads are enabled. This also fixes SIGHUPs crashing standby nodes if they've previously stepped down from active. [GH-3223]
auth/mfa: Correctly forward two-phase MFA validations on standby nodes. [GH-3246]
sys/namespaces: Support clearing a namespace's custom_metadata by providing a patch that sets custom_metadata to null at the top-level. [GH-3273]
sys/plugins: Fix /sys/plugins/catalog and /sys/plugins/catalog/<type> not returning versioned plugins. [GH-3186]

fix: versioned plugins missing in catalog response (#3186 by @phil9909) backported by @phil9909 in https://github.com/openbao/openbao/pull/3219
Replace zlint Docker container with go run (#3187 by @tsaarni) backported by @phil9909 in https://github.com/openbao/openbao/pull/3227
fix two-phase MFA failure on standby node (#3246 by @phil9909) backported by @phil9909 in https://github.com/openbao/openbao/pull/3248
Close the HA loop (#3223 by @satoqz) backported by @phil9909 in https://github.com/openbao/openbao/pull/3247
Refactor namespace patch & support top-level clear (#3273 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/3279
Remove expired certs in cassandra tests (#3256 by @tsaarni) backported by @satoqz in https://github.com/openbao/openbao/pull/3278
v2.5.5 dependency bumps by @satoqz in https://github.com/openbao/openbao/pull/3303
Fix panic due to unlock of unlocked mutex in Transit (#3309 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3312
Fix LDAP bind DN lookups in auth, secrets engine (#3306 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3313
Fix namespace path canonicalization (#3308 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/3311
Fix cross-namespace lease lookup routing (#3307 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/3310
Add changelog for v2.5.5 by @satoqz in https://github.com/openbao/openbao/pull/3314

Full Changelog: https://github.com/openbao/openbao/compare/v2.5.4...v2.5.5

auth/ldap: Prevent post-bind LDAP injection via bind DN to group resolution — GHSA-6mwx-4547-5vc9 (GH-3306)
secrets/ldap: Prevent potential LDAP injection with unsanitized DNs for service accounts — GHSA-6mwx-4547-5vc9 (GH-3306)
core/leases: Fix unauthorized cross‑namespace lease revocation via leaked lease identifiers — GHSA-c36x-h252-g9x2 (GH-3307)
core/namespaces: Fix namespace path canonicalization of "root" enabling unauthorized operations on the parent namespace — GHSA-mwr2-wmgp-crj6 (GH-3308)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track openbao

Get notified when new releases ship.

About openbao

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.