vaultwarden

Update docker.io/vaultwarden/server Docker tag to v1.33.0

Michi Kofler-Häusler

Michi Kofler-Häusler

— 3 min read
Update docker.io/vaultwarden/server Docker tag to v1.33.0
Photo by rc.xyz NFT gallery / Unsplash

Automatically upgrading Vaultwarden container with Watchtower and having to problems whatsoever with dependency update facilitated by Mend's Renovate Bot.

This MR contains the following updates:

Package Update Change
docker.io/vaultwarden/server minor 1.32.7 -> 1.33.0

Release Notes

dani-garcia/vaultwarden (docker.io/vaultwarden/server)

v1.33.0

Compare Source

Security Fixes

This release contains security fixes for the following advisories.
And we strongly advice to update as soon as possible.

  • GHSA-f7r5-w49x-gxm3
    This vulnerability is only possible if you do not have an ADMIN_TOKEN configured and open links or pages you should not trust anyway. Ensure you have an ADMIN_TOKEN configured to keep your admin environment save.
  • GHSA-h6cc-rc6q-23j4
    This vulnerability is only possible if someone was able to gain access to your Vaultwarden Admin Backend. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email.
  • GHSA-j4h8-vch3-f797
    This vulnerability affects all users who have multiple Organizations and users which are able to create a new organization or have admin or owner rights on at least one organization. The attacker does need to know the Organization UUID of the Organization it want's to attack or compromise though.

Notable changes

  • Updated web-vault to v2025.1.1
  • Added partial manage role support for collections
  • Manager role is converted to a Custom role with either Manage All Collections or per collection.
    Admins and Owners probably want to check and verify if the rights are still correct.
  • The OCI containers and binaries are signed via GitHub Attestations
    This allows you to verify an OCI image or even the vaultwarden binary located within the OCI image.

These vulnerabilities affects

What's Changed

New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.32.7...1.33.0

Read more

Me on Mastodon - This link is here for verification purposes.