Skip to content

v0.12.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 15:40
v0.12.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: NOxv8dcZlMFz3wrLdHILVNSnF6xskqAjN3bnn0i7K30
Verified
Learn about vigilant mode.
523f13c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release

Six findings from a full security review — one HIGH and five MEDIUM. Two carry behaviour changes; see Upgrade notes below before upgrading.

Fixes

  • Vault secrets no longer cached in cleartext (HIGH, #216). %vault(id)% references in site configuration were resolved eagerly when TYPO3 loaded the site configuration, and TYPO3 persists that array into its on-disk core cache — so decrypted secrets landed in var/cache in cleartext, with the per-principal access check applied only once, at cache-warm time. Resolution is now caller-driven, at read time.
  • CSV formula injection in audit-log exports (#218). Attacker-controlled audit fields (User-Agent, request id, identifiers) reached CSV exports without neutralizing spreadsheet formula leaders (= + - @, tab, CR); all four export sinks now neutralize them.
  • Secret leaked into the audit log (#217). A query-parameter-placed secret surfaced in an outbound-request error message that was logged verbatim; the URL query is now stripped before the message is sealed into the audit row.
  • Audit hash chain hardened against downgrade forgery (#221). Verification accepted a uniform relabel to keyless epoch-0 SHA-256, and the HMAC migration re-sealed the chain without verifying it first. Verification now enforces a configured-epoch floor, and the migration refuses to re-seal a chain that fails verification.
  • Delete access control on tx_nrvault_secret (#220). Deleting a secret via DataHandler (FormEngine, list module) enforced no vault ACL; it now requires owner / admin / system-maintainer.
  • Secret and master-key files created 0600 from the start (#219). vault:retrieve --output and vault:init left a world/group-readable window between the write and the chmod.

Upgrade notes

  • Site-configuration %vault()% references now resolve at read time, not automatically on load (#216, ADR-030). Code that read $site->getConfiguration()[…] and received a decrypted value must now call SiteConfigurationVaultProcessor::processConfiguration($config, $site) explicitly.
  • AuditLogServiceInterface gained verifyChainForReseal() and a verifyHashChain() $minEpoch parameter (#221); external implementers of the interface must implement the new method.
  • vault:retrieve / vault:init now abort on a failed chmod (#219), and a vault-ACL-denied delete now preserves the record and logs access_denied instead of soft-deleting (#220).

Installation

composer require netresearch/nr-vault

Publication status

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-vault-0.12.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-vault-0.12.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.

Assets 12
Loading