v1.4.0-rc1 Release Notes - December 10, 2018
--------------------------------------------
What's New in Hyperledger Fabric CA v1.4
----------------------------------------
No new features in Fabric CA v1.4. v1.4 is a maintenance release only,
with bug fixes, dependency updates, test improvements.
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
Other improvements and fixes
----------------------------
Updated to Go version 1.11.1
Updated baseimage version to 0.4.14
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v140-rc1
v1.4.0-rc2 Release Notes - December 20, 2018
--------------------------------------------
What's New in Hyperledger Fabric CA v1.4
----------------------------------------
No new features in Fabric CA v1.4. v1.4 is a maintenance release only,
with bug fixes, dependency updates, test improvements.
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
Other improvements and fixes
----------------------------
Updated to Go version 1.11.1
Updated baseimage version to 0.4.14
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v140-rc2
v1.4.1 Release Notes - April 11, 2019
-------------------------------------
What's New in Hyperledger Fabric CA v1.4.1
------------------------------------------
FABC-408 Add support for CORS
CORS can be enabled in Fabric CA server using new server flags:
--cors.enabled Enable CORS for the fabric-ca-server
--cors.origins Comma-separated list of Access-Control-Allow-Origin domains
FABC-782
Fabric CA API operational metrics
FABC-789
Fabric CA database operations metrics
FABC-743
Fabric CA health check
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
Other improvements and fixes
----------------------------
Updated to Go version 1.11.15
Updated baseimage version to 0.4.15
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/release-1.4/CHANGELOG.md#v141
v1.4.2 Release Notes - July 17, 2019
------------------------------------
What's New in Hyperledger Fabric CA v1.4.2
------------------------------------------
No new features.
Important Fixes
---------------
FABC-848 create table fails using Postgres with tls
Prior to the fix, when using Fabric CA with tls configured for Postres
database, the creation of the required tables fails upon initial
Fabric CA start.
FABC-837 Fabric CA panics when setup for multiple CAs
Prior to the fix, Fabric CA would panic upon start if configured
for multiple CAs (using --cafiles) and metric gathering.
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/release-1.4/CHANGELOG.md#v142
v1.4.3 Release Notes - August 26, 2019
--------------------------------------
What's New in Hyperledger Fabric CA v1.4.3
------------------------------------------
No new features.
Important Fixes
---------------
None.
Changes, Known Issues, and Workarounds
--------------------------------------
Go MySQL driver updated to version 2019-05-10T10:23:35Z.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/release-1.4/CHANGELOG.md#v143
v1.2.0-rc1 June 22, 2018
------------------------
Release Notes
-------------
Added support for listing certificates based on various filter criteria.
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Updated to Go version 1.10
Updated baseimage version to 0.4.8
Known Vulnerabilities
---------------------
[FAB-9938] many commands can be manipulated to delete identities or affiliations
This vulnerability has a low severity because to exploit it, one would need to
access the authorization header of the requests. Using HTTPS (TLS) eliminates this
potential. We will be re-evaluating the authorization approach for the v1.3
release.
Resolved Vulnerabilities
------------------------
https://jira.hyperledger.org/browse/FAB-7534
Known Issues & Workarounds
--------------------------
none
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v120-rc1
v1.3.0-rc1 Release Notes - September 24, 2018
---------------------------------------------
What's New in Hyperledger Fabric CA v1.3
----------------------------------------
The following features/epics are included in this release:
FABC-592 - Identity Mixer for anonymous transactions
Fabric-CA can now issue Identity Mixer credentials to enable anonymous and
unlinkable client identities through the use of zero-knowledge proofs.
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
None.
Resolved Vulnerabilities
------------------------
None.
Other improvements and fixes
----------------------------
Updated to Go version 1.10.4
Updated baseimage version to 0.4.12
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v130-rc1
v1.4.0 Release Notes - January 9th, 2019
----------------------------------------
What's New in Hyperledger Fabric CA v1.4
----------------------------------------
No new features in Fabric CA v1.4. v1.4 is a maintenance release only,
with bug fixes, dependency updates, test improvements.
Changes, Known Issues, and Workarounds
--------------------------------------
None.
Known Vulnerabilities
---------------------
FABC-174 Commands can be manipulated to delete identities or affiliations
This vulnerability can be resolved in one of two ways:
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
2) The token generation/authentication mechanism was improved to optionally prevent
token reuse. In v1.4 a more secure token can be used by setting environment variable:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
However, it cannot be set to false until all clients have
been updated to generate the more secure token and tolerate
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
The Fabric CA client has been updated in v1.4 to generate the more secure token.
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
at which time the default for Fabric CA server will change to:
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
Resolved Vulnerabilities
------------------------
None.
Other improvements and fixes
----------------------------
Updated to Go version 1.11.1
Updated baseimage version to 0.4.14
For the full list of improvements and fixes, refer to the release change log:
https://github.com/hyperledger/fabric-ca/blob/release-1.4/CHANGELOG.md#v140
v1.1.0-alpha January 25, 2018
-----------------------------
Release Notes
-------------
Added support for dynamic configurtion of the fabric-ca-server without requiring restart.
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Known Vulnerabilities
---------------------
none
Resolved Vulnerabilities
------------------------
none
Known Issues & Workarounds
--------------------------
none
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v110-alpha
v1.1.0-preview November 1, 2017
-------------------------------
Release Notes
-------------
Added support for CRLs and attribute based access control.
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Known Vulnerabilities
---------------------
none
Resolved Vulnerabilities
------------------------
none
Known Issues & Workarounds
--------------------------
none
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v110-preview
v1.1.0-rc1 March 1, 2018
-----------------------------
Release Notes
-------------
Added capability to dynamically modify affiliations.
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Updated to Go version 1.9.2
Updated baseimage version to 0.4.6
Known Vulnerabilities
---------------------
none
Resolved Vulnerabilities
------------------------
none
Known Issues & Workarounds
--------------------------
none
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v110-rc1
<h1>v1.0.0-beta June 8, 2017</h1>
<h2>Release Notes</h2>
Bug fixes, documentation and test coverage improvements, UX improvements based on user feedback and changes to address a variety of static scan findings (unused code, static security scanning, spelling, linting and more).
<h2>Known Vulnerabilities</h2>
none
<h2>Resolved Vulnerabilities</h2>
[FAB-4372](https://jira.hyperledger.org/browse/FAB-4372) The current logic only checked to see if an identity has a specific attribute. There was no check being made as to the actual value of the attribute. This was allowing certain execution of code that should have been prevented if the attribute had a value of false. For example, I can start a root server and register an identity with "hf.IntermediateCA=false", however I am still able to register this identity as an intermediate CA.
<h2>Known Issues & Workarounds</h2>
<h2>[Change Log](https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v100-beta)</h2>
v1.0.0-rc1 June 23, 2017
------------------------
Release Notes
-------------
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Known Vulnerabilities
---------------------
none
Resolved Vulnerabilities
------------------------
https://jira.hyperledger.org/browse/FAB-4856
Known Issues & Workarounds
--------------------------
https://jira.hyperledger.org/browse/FAB-4841
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v100-rc1
v1.0.0 July 11, 2017
------------------------
Release Notes
-------------
Bug fixes, documentation and test coverage improvements, UX improvements
based on user feedback and changes to address a variety of static scan
findings (unused code, static security scanning, spelling, linting and more).
Known Vulnerabilities
---------------------
none
Resolved Vulnerabilities
------------------------
https://jira.hyperledger.org/browse/FAB-5188
https://jira.hyperledger.org/browse/FAB-5203
Known Issues & Workarounds
--------------------------
none
Change Log
----------
https://github.com/hyperledger/fabric-ca/blob/master/CHANGELOG.md#v100
