Skip to content

2.1.3

Choose a tag to compare

View all tags
@overheadhunter overheadhunter released this 22 Oct 14:00
· 11 commits to develop since this release
Immutable release. Only release title and notes can be modified.
2.1.3
This tag was signed with the committer’s verified signature.
overheadhunter Sebastian Stenzel
SSH Key Fingerprint: 8zXPYql1PdqY76X2CfsNsvFTJ3BnwIlyhbZlnsHFTs0
Verified
Learn about vigilant mode.
c1ef09e
This commit was signed with the committer’s verified signature.
overheadhunter Sebastian Stenzel
SSH Key Fingerprint: 8zXPYql1PdqY76X2CfsNsvFTJ3BnwIlyhbZlnsHFTs0
Verified
Learn about vigilant mode.

Important

We urge you to apply this update as soon as possible to address these security vulnerabilities.

We will disclose vulnerability details once the fix has been applied to all our customers.

Existing emergency access setups are reset during the upgrade. Vault owners need to set up emergency access again for each vault.

What's Changed

Changed

  • Updated Keycloak to 26.7.5

Security

Details on the vulnerabilities below will be published as GitHub security advisories once users had time to update. Please upgrade promptly.

  • Fixed a vulnerability in the emergency access feature (GHSA-m34v-6wr7-hxpp)
  • Fixed a vulnerability in Web of Trust signature verification (GHSA-6h99-f755-pjr7)
  • Fixed a vulnerability affecting Web of Trust checks when granting vault access (GHSA-58gr-v8jr-2g56)
  • Fixed a denial-of-service vulnerability in client-side key material parsing (GHSA-x8hg-xmc2-pvfq)
  • Removed the CA root emSign ECC Root CA - G3 from the trust stores of the Hub and Keycloak images (JDK cacerts and OS bundle) after the eMudhra intermediate CA key compromise of 2026-10-17, see Mozilla bug 2083449. The Keycloak image is published as 26.7.5.1.

Full Changelog: 2.1.2...2.1.3

Assets 3
Loading