Vulnerability Disclosure: Authentication Bypass in Vaultwarden versions < 1.32.5

https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/

Please update Vaultwarden as soon as possible if you did not do it yet.

62 points · 5 comments · view on lemmy.world

5 Comments

cron@feddit.org · 22 pts · 1y

The blog post contains an interesting tineline. Apparently, the first fix was not sufficient. So if you have updated Vaultwaren before November 18, update it again.

Copy of the timeline:

  • End of October 2024: ERNW assesses Vaultwarden for the customer.
  • November 08, 2024: ERNW discloses the vulnerabilities to the Vaultwarden team.
  • November 10, 2024: Fix and release of Vaultwarden v1.32.4.
  • November 11, 2024: ERNW retests the software and identifies that the fix is not sufficient.
  • November 11, 2024: Public merge with fix and request for feedback by the Vaultwarden team.
  • November 12, 2024: ERNW acknowledges that the fix is complete.
  • November 18, 2024: Release of Vaultwarden v1.32.5.
zako@piefed.social · 7 pts · 1y (1 reply)

Hopefully, it was previously announced to update as soon as possible before disclosing the vulnerabilty. Good job by security experts and Vaultwarden team!

neshura@bookwormstory.social · 5 pts · 1y

Yes it was, the release notes explicitly specify it for 1.32.4 and 1.32.5

brownmustardminion@lemmy.ml · 4 pts · 1y (1 reply)

Am I understanding correctly that if users had 2FA, the vulnerability would be prevented from gaining access?

Branquinho@lemmy.eco.br · 4 pts · 1y

Correct. Only users without 2fa were in danger.