fabriziosalmi/certmate v2.51.1

v2.51.1 (a security release: an unconfigured instance, and a read-only key, are held to what they should see)

on GitHub

v2.51.1 (a security release: an unconfigured instance, and a read-only key, are held to what they should see)

A patch release, brought forward for security. It changes no feature. The findings come from a security review of the ACME server work (#476); each fix carries a test and a break-test.

The serious ones are reachable only while an instance is in setup mode: no first admin and no API_BEARER_TOKEN, open on the network. Every documented install sets API_BEARER_TOKEN, so it is not in setup mode. One issue affects any instance that has handed out a read-only key.

• Setup mode now accepts only the first admin. It serves every caller as admin so the first admin can be made; a list of refused paths left other lasting changes reachable by an anonymous caller: restoring a backup (which planted a deploy hook, and an admin API key that outlived setup), a storage migration (which copied every private key to a place the caller named), and OIDC or DNS settings that named a file or an environment variable for a secret to be sent to a server the caller named. Setup mode now refuses every write but the first admin and enabling local sign-in, refuses the reads that carry key material, and audits each refusal.
• A viewer no longer sees secrets in the settings. GET /api/settings and /api/settings/dns-providers, open to the viewer role, returned the dns_providers.multi token and the acme-dns username and subdomain in clear.
• A certificate directory inside the served /static/ folder is refused. Given to the storage settings, a test or a migration, it would have published every private key, unauthenticated, at /static/.
• A client certificate issued from a CSR is recorded as it was signed, by the CSR's subject and SANs, not the fields sent beside it.
• A password reset ends the account's other sessions.
• The rate limiters are thread-safe, and /api/auth/ endpoints other than login are under the request limiter.
• Smaller: SMTP notifications escape event content; a failed digest send returns no exception text; client private keys are written 0600 atomically; the admin-set HTTP clients (OIDC, Vault, Infisical, the DNS alias hook) refuse a cloud-metadata address; a private CA trust bundle is validated and written outside /tmp.

The API contract moves to 2.56 (MINOR: a client certificate's record gains subject_alt_names).

Read this before upgrading

Recovering onto a fresh host now needs an owner first

Restoring or uploading a backup is refused while an instance is in setup mode (no first admin, no API_BEARER_TOKEN), because a restore in that window could plant settings that outlive setup. This does not affect the documented installs, which set API_BEARER_TOKEN and so are never in setup mode. On a token-less fresh host, create the first admin (or set API_BEARER_TOKEN), sign in, then upload and restore. See backups.

If you hand out read-only keys

A viewer could read the dns_providers.multi credential and the acme-dns username and subdomain from GET /api/settings before this release. Rotate those if a viewer key was held by anyone who should not have seen them.

Security

See the advisory for the full account. In short: the setup-mode issues require an instance with no first admin and no API_BEARER_TOKEN, reachable on the network; set API_BEARER_TOKEN (as the installers do) and do not expose a not-yet-onboarded instance.