release v1.8.0

CHANGELOG.md

@@ -6,13 +6,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [1.8.0] - 2020-07-10
 ### Changed
-- Uses OpenSSL 1.0.2u to support FIPS compliance
-  ([cyberark/conjur#1527](https://github.com/cyberark/conjur/issues/1527))
+- Use OpenSSL 1.0.2u to support FIPS compliance.
+  [cyberark/conjur#1527](https://github.com/cyberark/conjur/issues/1527)
 - Conjur can be configured to run in FIPS compliant or Non-FIPS compliant mode depending on requirements.
-  FIPS Compliant mode is slightly slower then non-FIPS compliant
-  ([cyberark/conjur#1527](https://github.com/cyberark/conjur/issues/1527))
-- Bump conjur-rack from 4.0.0 to 4.2.0 that consumes FIPS compliant slosilo(https://github.com/cyberark/conjur/issues/1527))
+  FIPS Compliant mode is slightly slower then non-FIPS compliant.
+  [cyberark/conjur#1527](https://github.com/cyberark/conjur/issues/1527)
+- Bump conjur-rack from 4.0.0 to 4.2.0 that consumes FIPS compliant slosilo.
+  [cyberark/conjur#1527](https://github.com/cyberark/conjur/issues/1527)
 - Print login and authentication error to the log in INFO level.
   [cyberark/conjur#1377](https://github.com/cyberark/conjur/issues/1377)
 - Print proper message when user does not exist in authn or login request with
@@ -21,14 +23,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Added
 - Password changes (`PUT /authn/:account/password`) now produce audit events with
-  message ID `password` ([cyberark/conjur#1548](https://github.com/cyberark/conjur/issues/1548))
+  message ID `password`. [cyberark/conjur#1548](https://github.com/cyberark/conjur/issues/1548)
 - API key rotations (`PUT /:authenticator/:account/api_key`) now produce audit events with
-  message ID `api-key` ([cyberark/conjur#1549](https://github.com/cyberark/conjur/issues/1549))
+  message ID `api-key`. [cyberark/conjur#1549](https://github.com/cyberark/conjur/issues/1549)
 - All audit events now contain the IP address of the client that initiated the
-  API request (e.g. `[client@43868 ip="172.24.0.5"]`)
-  ([cyberark/conjur#1550](https://github.com/cyberark/conjur/issues/1550))
+  API request (e.g. `[client@43868 ip="172.24.0.5"]`).
+  [cyberark/conjur#1550](https://github.com/cyberark/conjur/issues/1550)
 - Print Conjur server FIPS mode status. [cyberark/conjur#1654](https://github.com/cyberark/conjur/issues/1654)
 
+### Security
+- Updated `rack` to `2.2.3` to resolve CVE-2020-8184. [cyberark/conjur#1643](https://github.com/cyberark/conjur/pull/1643)
+
 ## [1.7.4] - 2020-06-17
 
 ### Fixed
@@ -376,7 +381,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 - The first tagged version.
 
-[Unreleased]: https://github.com/cyberark/conjur/compare/v1.7.4...HEAD
+[Unreleased]: https://github.com/cyberark/conjur/compare/v1.8.0...HEAD
+[1.8.0]: https://github.com/cyberark/conjur/compare/v1.7.4...v1.8.0
 [1.7.4]: https://github.com/cyberark/conjur/compare/v1.7.3...v1.7.4
 [1.7.3]: https://github.com/cyberark/conjur/compare/v1.7.2...v1.7.3
 [1.7.2]: https://github.com/cyberark/conjur/compare/v1.7.1...v1.7.2

NOTICES.txt

@@ -25,10 +25,10 @@ Section 4: MIT
 
 >>> https://rubygems.org/gems/activesupport/versions/5.2.4.3
 >>> https://rubygems.org/gems/base58/versions/0.2.3
->>> https://rubygems.org/gems/bcrypt-ruby/versions/3.0.1
+>>> https://rubygems.org/gems/bcrypt/versions/3.1.13
 >>> https://rubygems.org/gems/command_class/versions/0.0.2
 >>> https://rubygems.org/gems/conjur-policy-parser/versions/3.0.4
->>> https://rubygems.org/gems/conjur-rack/versions/4.0.0
+>>> https://rubygems.org/gems/conjur-rack/versions/4.2.0
 >>> https://rubygems.org/gems/conjur-rack-heartbeat/versions/2.2.0
 >>> https://rubygems.org/gems/dry-struct/versions/0.4.0
 >>> https://rubygems.org/gems/dry-types/versions/0.12.3
@@ -42,8 +42,7 @@ Section 4: MIT
 >>> https://rubygems.org/gems/mini_racer/versions/0.2.9
 >>> https://rubygems.org/gems/net-ldap/versions/0.16.2
 >>> https://rubygems.org/gems/nokogiri/versions/1.10.9
->>> https://rubygems.org/gems/openid_connect/versions/1.1.8
->>> https://rubygems.org/gems/rack/versions/2.2.2
+>>> https://rubygems.org/gems/openid_connect/versions/1.2.0
 >>> https://rubygems.org/gems/rack-rewrite/versions/1.5.1
 >>> https://rubygems.org/gems/rails/versions/5.2.4.3
 >>> https://rubygems.org/gems/rake/versions/13.0.1
@@ -53,7 +52,7 @@ Section 4: MIT
 >>> https://rubygems.org/gems/sequel-postgres-schemata/versions/0.1.3
 >>> https://rubygems.org/gems/sequel-rails/versions/1.1.0
 >>> https://rubygems.org/gems/simplecov/versions/0.14.1
->>> https://rubygems.org/gems/slosilo/versions/2.1.1
+>>> https://rubygems.org/gems/slosilo/versions/2.2.1
 >>> https://rubygems.org/gems/uglifier/versions/4.2.0
 >>> https://rubygems.org/gems/websocket-client-simple/versions/0.3.0
 
@@ -268,7 +267,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
->>> https://rubygems.org/gems/bcrypt-ruby/versions/3.0.1
+>>> https://rubygems.org/gems/bcrypt/versions/3.1.13
 
 Copyright 2007-2011:
 
@@ -339,9 +338,9 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
->>> https://rubygems.org/gems/conjur-rack/versions/4.0.0
+>>> https://rubygems.org/gems/conjur-rack/versions/4.2.0
 
-Copyright (c) 2013 Kevin Gilpin
+Copyright (c) 2020 CyberArk Software Ltd. All rights reserved.
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -654,12 +653,10 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
->>> https://rubygems.org/gems/openid_connect/versions/1.1.8
+>>> https://rubygems.org/gems/openid_connect/versions/1.2.0
 
 Copyright (c) 2011 nov matake
 
-MIT License
-
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
@@ -679,28 +676,6 @@ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
->>> https://rubygems.org/gems/rack/versions/2.2.2
-
-Copyright (C) 2007-2019 Leah Neukirchen <http://leahneukirchen.org/infopage.html>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
 >>> https://rubygems.org/gems/rack-rewrite/versions/1.5.1
 
 Copyright (c) 2012 — John Trupiano, Travis Jeffery
@@ -901,7 +876,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
->>> https://rubygems.org/gems/slosilo/versions/2.1.1
+>>> https://rubygems.org/gems/slosilo/versions/2.2.1
 
 Copyright (c) 2020 CyberArk Software Ltd. All rights reserved.
 

VERSION

@@ -1 +1 @@
-1.7.4
+1.8.0