1.32.0

[BlackDex]

Security Fixes

This release has several CVE Reports fixed and we recommend everybody to update to the latest version as soon as possible.

• CVE-2024-39924 Fixed via Some fixes for emergency access #4715
• CVE-2024-39925 Fixed via Fix data disclosure on organization endpoints #4837
• CVE-2024-39926 Fixed via Update admin interface #4737

Other changes

• Updated web-vault to v2024.6.2
• Fixed issues with password reset enrollment by rolling back a web-vault commit

What's Changed

• use a custom plan of enterprise tier to fix limits by @stefan0xC in use a custom plan of enterprise tier to fix limits #4726
• chore: Dockerfile to Remove port 3012 by @calvin-li-developer in chore: Dockerfile to Remove port 3012 #4725
• Fix bug where secureNotes is empty by @cobyge in Fix bug where secureNotes is empty #4730
• Improved HTTP client by @dani-garcia in Improved HTTP client #4740
• Update admin interface by @BlackDex in Update admin interface #4737
• Fix for RSA Keys which are read only by @BlackDex in Fix for RSA Keys which are read only #4744
• Fix Email 2FA login on native app by @BlackDex in Fix Email 2FA login on native app #4762
• Update crates & fix crate vulnerability by @dfunkt in Update crates & fix crate vulnerability #4771
• Fix Dockerfile linter warnings by @dfunkt in Fix Dockerfile linter warnings #4763
• allow re-invitations of existing users by @stefan0xC in allow re-invitations of existing users #4768
• Allow to override log level for specific target by @Timshel in Allow to override log level for specific target #4305
• Add support for MFA with Duo's Universal Prompt by @0x0fbc in Add support for MFA with Duo's Universal Prompt #4637
• Allow to increase the note size to 100_000 by @BlackDex in Allow to increase the note size to 100_000 #4772
• Update Rust, Crates and GHA by @BlackDex in Update Rust, Crates and GHA #4783
• Duo: use the formatted db email by @Timshel in Duo: use the formatted db email #4779
• Update rust-toolchain.toml to 1.80.0 by @dfunkt in Update rust-toolchain.toml to 1.80.0 #4784
• fix issue with adding ciphers to organizations on native ios app by @stefan0xC in fix issue with adding ciphers to organizations on native ios app #4800
• Rewrite the Push Notifications section in the configuration template by @dfunkt in Rewrite the Push Notifications section in the configuration template #4805
• Secure send file uploads by @BlackDex in Secure send file uploads #4810
• make access_all optional by @stefan0xC in make access_all optional #4812
• Remove lowercase conversion for featureStates by @dfunkt in Remove lowercase conversion for featureStates #4820
• Fix mail::send_incomplete_2fa_login panic issue by @dfunkt in Fix mail::send_incomplete_2fa_login panic issue #4792
• Update crates, web-vault and fixes by @BlackDex in Update crates, web-vault and fixes #4823
• Updated web-vault to v2024.6.2b by @BlackDex in Updated web-vault to v2024.6.2b #4826
• Update Rust to 1.80.1 by @dfunkt in Update Rust to 1.80.1 #4831
• Fix data disclosure on organization endpoints by @BlackDex in Fix data disclosure on organization endpoints #4837

New Contributors

• @cobyge made their first contribution in Fix bug where secureNotes is empty #4730
• @0x0fbc made their first contribution in Add support for MFA with Duo's Universal Prompt #4637

Full Changelog: 1.31.0...1.32.0

---

This discussion was created from the release 1.32.0.

[PhilIngGood]

Loving all fixes and the new HUD, great job !

[dianasta21]

Thanks for the fixes!.

I'm always getting the folllowing error with DUO [ERROR] Duo health check failed, got OK-like body with stat FAIL. Pls see below the log details. If I downgrade back to 1.31.0, there is no error.

I have updated DUO to Universal Prompt.

[2024-08-12 16:58:07.760][start][INFO] Rocket has launched from http://0.0.0.0:80
[2024-08-12 16:58:42.422][request][INFO] GET /api/devices/knowndevice
[2024-08-12 16:58:42.424][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK
[2024-08-12 16:58:43.849][request][INFO] POST /api/auth-requests/
[2024-08-12 16:58:45.416][response][INFO] (post_auth_request) POST /api/auth-requests => 200 OK
[2024-08-12 16:58:45.851][request][INFO] GET /notifications/anonymous-hub?Token=2xxxxxxxx1-xxxx-xxxx-a012-
[2024-08-12 16:58:45.851][vaultwarden::api::notifications][INFO] Accepting Anonymous Rocket WS connection from ***.***.***.46
[2024-08-12 16:58:45.851][response][INFO] (anonymous_websockets_hub) GET /notifications/anonymous-hub?<token..> => 200 OK
[2024-08-12 16:58:57.923][response][INFO] (get_auth_request_response) GET /api/auth-requests/<uuid>/response?<code> => 200 OK
[2024-08-12 16:58:58.007][request][INFO] POST /identity/connect/token
[2024-08-12 16:58:58.179][request][INFO] GET /api/auth-requests/
[2024-08-12 16:58:58.182][response][INFO] (get_auth_requests) GET /api/auth-requests => 200 OK
**[2024-08-12 16:58:58.405][vaultwarden::api::core::two_factor::duo_oidc][ERROR] Duo health check failed, got OK-like body with stat FAIL**
[2024-08-12 16:58:58.405][response][INFO] (login) POST /identity/connect/token => 400 Bad Request
[2024-08-12 16:58:58.467][vaultwarden::api::notifications][INFO] Closing WS connection from xxx.xxx.xxx.46
[2024-08-12 16:58:58.481][request][INFO] GET /api/devices/knowndevice
[2024-08-12 16:58:58.482][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK

[extrafein]

Thanks for the fixes!.

I'm always getting the folllowing error with DUO [ERROR] Duo health check failed, got OK-like body with stat FAIL. Pls see below the log details. If I downgrade back to 1.31.0, there is no error. It looks like this line below missing the last part of the token maybe? [2024-08-12 16:58:45.851][request][INFO] GET /notifications/anonymous-hub?Token=2xxxxxxxx1-xxxx-xxxx-a012- I have updated DUO to Universal Prompt.

Hi, I had the same issue.
I solved it by creating a new Application within DUO and using the new keys and host in the Vaultwarden config.
After a restart it was working with the new Universal Prompt.

[dianasta21]

Thanks for the fixes!.
I'm always getting the folllowing error with DUO [ERROR] Duo health check failed, got OK-like body with stat FAIL. Pls see below the log details. If I downgrade back to 1.31.0, there is no error. It looks like this line below missing the last part of the token maybe? [2024-08-12 16:58:45.851][request][INFO] GET /notifications/anonymous-hub?Token=2xxxxxxxx1-xxxx-xxxx-a012- I have updated DUO to Universal Prompt.

Hi, I had the same issue. I solved it by creating a new Application within DUO and using the new keys and host in the Vaultwarden config. After a restart it was working with the new Universal Prompt.

Thanks,
I fixed it by re-creating the app in DUO and restarting Vaultwarden, is working fine now!