github.com/hashicorp/consul

SECURITY:

• Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

BUG FIXES:

• api: fixed a panic caused by an api request with Connect=null [GH-8537]

BUG FIXES:

• vendor: update github.com/armon/go-metrics to v0.3.4 to mitigate a potential panic when emitting Prometheus metrics at an interval longer than the metric expiry time [GH-8478]

BUG FIXES:

• agent: Fixed an issue with lock contention during RPCs when under load while using the Prometheus metrics sink. [GH-8372]
• gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms [GH-8345]

SECURITY:

• Adding an option http_config.use_cache to disable agent caching for http endpoints, because Consul’s DNS and HTTP API expose a caching feature susceptible to DoS. CVE-2020-13250 [GH-8023]
• Propagate and enforce changes to legacy ACL tokens rules in secondary data centers. CVE-2020-12797 [GH-8047]
• Only resolve local acl token in the datacenter it belongs to. CVE-2020-13170 [GH-8068]

BUG FIXES:

• acl: Fixed an issue where legacy management tokens could not be used in secondary datacenters. [GH-7908]
• agent: Fixed a race condition that could cause an agent to crash when first starting. [GH-7955]

BUG FIXES:

• agent: (Consul Enterprise only) Fixed several bugs related to Network Area and Network Segment compatibility with other features caused by incorrectly doing version or serf tag checking. [GH-7551]

SECURITY:

• dns: Updated miekg/dns dependency to fix a memory leak and CVE-2019-19794. [GH-6984], [GH-7261]

SECURITY

• agent: mitigate potential DoS vector allowing unbounded server resource usage from unauthenticated connections [GH-7159]
• acl: add ACL enforcement to the v1/agent/health/service/* endpoints [GH-7160]

IMPROVEMENTS

• tls: auto_encrypt and verify_incoming [GH-6811]

BUG FIXES

• agent: output proper HTTP status codes for Txn requests that are too large [GH-7158]
• connect: derive connect certificate serial numbers from a memdb index instead of the provider table max index [GH-7011]
• connect: ensure that updates to the secondary root CA configuration use the correct signing key ID values for comparison [GH-7012]

SECURITY

• Updated to compile with Go 1.12.13 which includes a fix for CVE-2019-17596 in [Go 1.12.11] [GH-6319]

FEATURES

• agent: store check type in catalog [GH-6561]
• agent: update force-leave to allow for complete removal of members [GH-6571]
• agent: updates to the agent token trigger anti-entropy full syncs [GH-6577]
• snapshot agent (Consul Enterprise): Added support for saving snapshots to Google Cloud Storage.
• connect: Added proxy config stanza to allow exposing HTTP paths through Envoy for non-Connect-enabled services [GH-5396]

IMPROVEMENTS

• licensing (Consul Enterprise): Increase initial server temporary license duration to 6 hours to allow for longer upgrades/migrations.
• server: ensure the primary datacenter and ACL datacenter match [GH-6634]
• sdk: ignore panics due to stray goroutines logging after a test completes [GH-6632]
• agent: allow mesh gateways to initialize even if there are no connect services registered yet [GH-6576]
• agent: endpoint performance improvements, Txn endpoint in particular. [GH-6680]
• sdk: add NewTestServerT, deprecate NewTestServer in testutil to prevent nil point dereference [GH-6761]
• agent: auto_encrypt provided TLS certificates can now be used to enable HTTPS on clients [GH-6489]
• sentinel (Consul Enterprise): update to v0.13.0, see Sentinel changelog for more details

BUG FIXES

• ARM release binaries: Starting with v1.6.2, Consul will ship three separate versions of ARM builds. The previous ARM binaries of Consul could potentially crash due to the way the Go runtime manages internal pointers to its Go routine management constructs and how it keeps track of them especially during signal handling. From v1.6.2 forward, it is recommended to use:
  • consul_{version}_linux_armelv5.zip for all 32-bit armel systems
  • consul_{version}_linux_armhfv6.zip for all armhf systems with v6+ architecture
  • consul_{version}_linux_arm64.zip for all v8 64-bit architectures
• agent: Parse the HTTP Authorization header as case-insensitive. [GH-6568]
• agent: minimum quorum check added to Autopilot with minQuorum option [GH-6654]
• agent: cache notifications work after error if the underlying RPC returns index=1 [GH-6547]
• agent: tolerate more failure scenarios during service registration with central config enabled [GH-6472]
• cache: remove data race in agent cache [GH-6470]
• connect: connect CA Roots in secondary datacenters should use a SigningKeyID derived from their local intermediate [GH-6513]
• connect: don't colon-hex-encode the AuthorityKeyId and SubjectKeyId fields in connect certs [GH-6492]
• connect: intermediate CA certs generated with the vault provider lack URI SANs [GH-6491]
• debug: Fix a bug in sync.WaitGroup usage. [GH-6649]
• xds: tcp services using the discovery chain should not assume RDS during LDS [GH-6623]
• ui: Fix a bug where switching datacenters using the datacenter menu would lead to an empty service listing [GH-6555]