During a penetration test for a customer, we briefly assessed Vaultwarden, an open-source online password safe. In June 2024, the German Federal Office for Information Security (BSI) published results1 of a static and dynamic test of the Vaultwarden server component. Therefore, only a partial source code audit was performed during our assessment. However, a quick look was needed to find some g ...

Please update Vaultwarden as soon as possible if you did not do it yet.

  • cron@feddit.orgEnglish
    22·
    1 month ago

    The blog post contains an interesting tineline. Apparently, the first fix was not sufficient. So if you have updated Vaultwaren before November 18, update it again.

    Copy of the timeline:

    • End of October 2024: ERNW assesses Vaultwarden for the customer.
    • November 08, 2024: ERNW discloses the vulnerabilities to the Vaultwarden team.
    • November 10, 2024: Fix and release of Vaultwarden v1.32.4.
    • November 11, 2024: ERNW retests the software and identifies that the fix is not sufficient.
    • November 11, 2024: Public merge with fix and request for feedback by the Vaultwarden team.
    • November 12, 2024: ERNW acknowledges that the fix is complete.
    • November 18, 2024: Release of Vaultwarden v1.32.5.
  • zako@piefed.socialEnglish
    7·
    1 month ago

    Hopefully, it was previously announced to update as soon as possible before disclosing the vulnerabilty. Good job by security experts and Vaultwarden team!

    • BranquinhoOPEnglish
      4·
      1 month ago

      Correct. Only users without 2fa were in danger.