Hi all,
The Vault team is announcing the release of Vault Community Edition 2.0.2 and Vault Enterprise 2.0.2, 1.21.7, 1.20.12, and 1.19.18.
The 2.0.2 Community Edition and Enterprise editions are available on our releases portal [1,10].
As a reminder, if you believe you have found a security issue in Vault, please responsibly disclose by emailing security@hashicorp.com and do not use the public issue tracker. Our security policy and our PGP key can be found at [2].
Notable changes in the release are:
-
Vault container images now run as the vault user instead of root and no longer require IPC_LOCK capabilities to run. HashiCorp continues to recommend running Vault with memory locked whenever possible, to prevent unintended access to sensitive data through memory paging to disk. See the Vault docs for additional explanation and guidance.
-
Fixed a crash in Secrets Sync, triggered in some cases of establishing a new sync destination.
See the Changelog at [3] for the full list of improvements and bug fixes.
See the Feature Deprecation Notice and Plans page [8] for our upcoming feature deprecation plans.
Community [6] and Enterprise [7] Docker images will be available soon.
Upgrading
See [4] for general upgrade instructions and [5] for upgrade instructions and known issues.
As always, we recommend upgrading and testing this release in an isolated environment. If you experience any non-security issues, please report them on the Vault GitHub issue tracker or post to the Vault Discuss Forum at [9].
We hope you enjoy Vault 2.0.2!
Sincerely, The Vault Team
[1] Vault v2.0.2 Binaries | HashiCorp Releases
[2] https://www.hashicorp.com/security
[3] vault/CHANGELOG.md at main · hashicorp/vault · GitHub
[4] Upgrade Vault | Vault | HashiCorp Developer
[5] Release notes - 2.x | Vault | HashiCorp Developer
[6] hashicorp/vault - Docker Image
[7] hashicorp/vault-enterprise - Docker Image