v4.39.20
Fixed 15
- Fix incorrect bind mode in authentication
- Implement case-insensitive domain matching in authorization
- Fix oauth2 client credentials being considered anonymous
- Add default attributes to freeipa configuration
- Include specific warning about ports in configuration
- Preserve dots in map key names during koanf remap
- Add missing extensions to expression
- Fix hoist issuer checks in handlers
- Ensure unknown bans are measured in metrics
- Fix go collectors not being registered in metrics
- Add rate limit exclusions to middlewares
- Add startup check for backend connectivity in session
- Harden one-time code consumption in storage
- Fix incorrect query used for auth code by request ID in storage
- Quote peer dependency versions in pnpm-workspace for web
Security 2
- Fix edge case access control rule domain miss due to lack of canonicalization
- Fix missing username canonicalization in basic auth when using LDAP
Security Fixes
This release contains important security fixes. We encourage users to update as soon as practical.
The following advisories accompany this release:
- Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723
- Missing Username Canonicalization in Basic Auth when using LDAP reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723
Bug Fixes
- authentication: incorrect bind mode (#12094) (dc1d1d6) by @james-d-elliott
- authorization: case-insensitive domain matching [security] (#12169) (b6d1d60) by @james-d-elliott
- authorization: oauth2 client credentials considered anonymous (#12141) (54de0c9) by @james-d-elliott
- configuration: add default attributes to freeipa (#12155) (f8203be) by @kaysond
- configuration: include specific warning about ports (#12145) (033533e) by @james-d-elliott
- configuration: preserve dots in map key names during koanf remap (#11803) (211a4cd) by @nightah
- expression: add missing extensions (#11226) (4c7ffd3) by @james-d-elliott
- handlers: basic auth username canonicalization [security] (#12170) (b8985b5) by @james-d-elliott
- handlers: hoist issuer checks (#12160) (ab5dca7) by @james-d-elliott
- metrics: ensure unknown bans are measured (#11999) (3adae90), closes #11972 by @james-d-elliott
- metrics: go collectors not registered (#11894) (9cd8812) by @james-d-elliott
- middlewares: add rate limit exclusions (#12159) (17397cd) by @james-d-elliott
- session: add startup check for backend connectivity (#12157) (8149b6f) by @nightah
- storage: harden one-time code consumption (#12095) (9dc3eb6) by @james-d-elliott
- storage: incorrect query used for auth code by req id (#12139) (dc6365d) by @james-d-elliott
- web: quote peer dependency versions in pnpm-workspace (#12049) (1fb10aa), closes #12032 by @nightah
New Contributors
- @nicomem made their first contribution in https://github.com/authelia/authelia/pull/11885
- @TanguyBaudrin made their first contribution in https://github.com/authelia/authelia/pull/11750
- @turtleinarock made their first contribution in https://github.com/authelia/authelia/pull/11912
- @rpadovani made their first contribution in https://github.com/authelia/authelia/pull/11720
- @arylatt made their first contribution in https://github.com/authelia/authelia/pull/11899
- @dubwoc made their first contribution in https://github.com/authelia/authelia/pull/11933
Docker Container
docker pull authelia/authelia:4.39.20docker pull ghcr.io/authelia/authelia:4.39.20