Security Fixes

This release has several CVE Reports fixed and we recommend everybody to update to the latest version as soon as possible.

• CVE-2024-39924 Fixed via #4715
• CVE-2024-39925 Fixed via #4837
• CVE-2024-39926 Fixed via #4737

Other changes

• Updated web-vault to v2024.6.2
• Fixed issues with password reset enrollment by rolling back a web-vault commit

What’s Changed

• use a custom plan of enterprise tier to fix limits by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/4726
• chore: Dockerfile to Remove port 3012 by @calvin-li-developer in https://github.com/dani-garcia/vaultwarden/pull/4725
• Fix bug where secureNotes is empty by @cobyge in https://github.com/dani-garcia/vaultwarden/pull/4730
• Improved HTTP client by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/4740
• Update admin interface by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4737
• Fix for RSA Keys which are read only by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4744
• Fix Email 2FA login on native app by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4762
• Update crates & fix crate vulnerability by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4771
• Fix Dockerfile linter warnings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4763
• allow re-invitations of existing users by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/4768
• Allow to override log level for specific target by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/4305
• Add support for MFA with Duo’s Universal Prompt by @0x0fbc in https://github.com/dani-garcia/vaultwarden/pull/4637
• Allow to increase the note size to 100_000 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4772
• Update Rust, Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4783
• Duo: use the formatted db email by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/4779
• Update rust-toolchain.toml to 1.80.0 by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4784
• fix issue with adding ciphers to organizations on native ios app by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/4800
• Rewrite the Push Notifications section in the configuration template by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4805
• Secure send file uploads by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4810
• make access_all optional by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/4812
• Remove lowercase conversion for featureStates by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4820
• Fix mail::send_incomplete_2fa_login panic issue by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4792
• Update crates, web-vault and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4823
• Updated web-vault to v2024.6.2b by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4826
• Update Rust to 1.80.1 by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/4831
• Fix data disclosure on organization endpoints by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/4837

New Contributors

• @cobyge made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/4730
• @0x0fbc made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/4637

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.31.0…1.32.0