v0.10.1

What's in this release

A security-hardening release: it closes three ways a determined attacker could have worked around the vault's protections, and fixes several robustness issues in the outbound-request defences.

Server-side request forgery: numeric IP bypass closed

The vault blocks outbound requests aimed at internal addresses, but curl's resolver quietly accepts unusual numeric spellings of an address — decimal, octal, hex, and abbreviated forms — that all reach a loopback or internal host while slipping past the standard address check as if they were ordinary hostnames. Those forms are now rejected unless an operator explicitly allowlists the exact literal; normal dotted-quad and IPv6 addresses are unaffected.

Secret access control: privilege-escalation path closed

On the secret editing form, the fields that decide who owns a secret and which groups may read or write it were editable by any editor who could open the form — so a non-admin could widen a secret's access or reassign its ownership to themselves. Those privileged fields now require owner or admin authorization.

Audit log: tamper-evidence hardened

The audit log is a hash chain so that after-the-fact tampering shows up. Two ways a database-level attacker could have rewritten history while keeping the chain looking intact — a downgrade to a weaker, keyless hash, and a forged attribution — are now detected by chain verification.

Robustness fixes

• Requests to dual-stack hosts (for example api.github.com) work again from environments without IPv6: the DNS-rebinding pin no longer discards all but the last resolved address, so curl's normal cross-address fallback is restored while every address it connects to remains one the defence vetted.
• The SSRF middleware no longer fatals on installations that do not have the curl extension.
• The secret field's description renders exactly once on both TYPO3 v13 and v14.

Installation

composer require netresearch/nr-vault

Publication status

• TER: extensions.typo3.org/extension/nr_vault — 0.10.1 verified
• Packagist: packagist.org/packages/netresearch/nr-vault — 0.10.1 verified
• Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-vault/0.10/en-us/

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-vault-0.10.1.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-vault-0.10.1.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.