Version 1.24.x

Version 1.24.x#

Release notes for Nubus for Kubernetes 1.24.x:

Version 1.24.0 - 2026-10-27#

Upgrade path

For the upgrade to version 1.24.0, your deployment must run on version 1.23.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Release highlights#

Self Service malware scan

The Self Service can now scan uploaded files, for example profile pictures, for malware with an ICAP server.

Keycloak update

Keycloak has been updated to version 26.8.1. Please be aware of the migration steps, see v1.24.0 - Migration steps.

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. Operators upgrading from 1.23.0 need to follow and apply the migration steps outlined in v1.23.1 - Migration steps.

  2. Keycloak: Audience mappers for OIDC clients Keycloak 26.8.1 silently ignores OIDC audience mappers that use the Included Client Audience setting with a value that does not match the client ID of an existing and enabled Keycloak client.

    Nubus for Kubernetes 1.23.2 prepared deployments for this change, but with Keycloak 26.8.1 in 1.24.0 broken audience mappers are no longer accepted.

    Before the upgrade, check all OIDC clients for broken audience mappers and repair them with the fix-audience-mappers script. The command reads the Keycloak URL, realm, and administrator credentials from the most recent Keycloak bootstrap pod. Replace {NAMESPACE} with the namespace of your Nubus for Kubernetes deployment.

    NS={NAMESPACE}
IMAGE=artifacts.software-univention.de/nubus/images/keycloak-bootstrap:26.7.4-nubus4@sha256:3e38cbff07f06905cd1bbf87390d9585d47ac6792e2608d46758787bc4d47f4f

POD=$(kubectl get pods -n "$NS" -l app.kubernetes.io/name=keycloak-bootstrap \
        --sort-by=.metadata.creationTimestamp -o name | tail -1)

kubectl debug -n "$NS" "$POD" --copy-to=keycloak-fix-audience --container=main \
  --set-image=main="$IMAGE" \
  -- sh -c '/usr/share/univention-keycloak/fix-audience-mappers \
      --realm "$KEYCLOAK_REALM" \
      --keycloak-url "$KEYCLOAK_URL" --binduser "$KEYCLOAK_USERNAME" \
      --bindpwdfile /credentials/keycloak.secret --dry-run'

kubectl wait -n "$NS" --for=jsonpath='{.status.phase}'=Succeeded \
  pod/keycloak-fix-audience --timeout=60s
kubectl logs -n "$NS" -f keycloak-fix-audience -c main
kubectl delete pod -n "$NS" keycloak-fix-audience

    Run the same command without the --dry-run flag to repair the OIDC audience mapper configuration on all existing OIDC clients before upgrading to 1.24.0.

    For more information, see https://help.univention.com/t/25737.

Changes#

This section lists the changes in 1.24.0 grouped by component in Nubus for Kubernetes.

2FA Helpdesk#

The twofa-helpdesk-backend container image now uses a distroless Python base image and contains only the software packages the 2FA Helpdesk backend needs at runtime. This reduces the SBOM components in the image by 66%, from 159 to 54 software packages. The new image fixes the following security findings:

Guardian#

Upgrade Cerbos in the Guardian to version 0.57.0. This includes fixes for the following security findings:

LDAP server#

  • The leader elector sidecar container in the LDAP server primary pods now mounts the LDAP data volume read-only. The leader elector only checks whether the LDAP database exists and can no longer change it.

  • Disabling a user account no longer invalidates the password hash stored in the LDAP attribute userPassword. This allows the Keycloak Identity Provider to distinguish a disabled account from invalid credentials and report the appropriate authentication error. The shadowbind LDAP overlay is now mandatory to ensure that disabled user accounts cannot authenticate using LDAP bind.

  • The noopsrch overlay has been added to LDAP server pods.

  • The shadowbind overlay has been adjusted to reject LDAP binds when shadowLastChange is 0. According to the semantics of the shadow password attributes, a value of shadowLastChange=0 indicates that the password must be changed before it can be used for further authentication.

Portal Frontend#

The Your profile page in the End User Self Service now shows an error message if the UMC server doesn’t save the changes, for example if the malware scan rejects an uploaded file. Earlier versions didn’t show a message and the page didn’t change.

Provisioning Service#

Keycloak service#

Upgrade Keycloak to version 26.8.1. This includes fixes for the following security findings:

Self Service Consumer#

The selfservice-invitation container image now uses a distroless Python base image and contains only the software packages the Self Service Consumer needs at runtime. This reduces the SBOM components in the image by 58%, from 118 to 49 software packages. The new image fixes the following security findings:

UMC server#

  • The End User Self Service can now scan uploaded files for malware, for example profile pictures. It sends the files over TCP to an ICAP service, for example c-icap with ClamAV. If the ICAP service finds malware or can’t scan the file, the End User Self Service rejects the file. The malware scan is inactive by default. To activate it, set the value nubusUmcServer.selfService.malwareScan.icap.url. For more information, see Malware scan of uploaded files in End User Self Service in Univention Nubus for Kubernetes - Operation Manual [1].

  • The UDM REST API no longer crashes on a corrupted or concurrently-evicted entry in its internal authentication cache.

UDM HTTP REST API#

  • The performance of counting license usage has been improved.

  • UDM now preserves the account expiration date when disabling a user account.

Included errata updates#

The errata updates contain fixes for the following CVEs:

aiohttp
bcprov-jdk18on
cryptography
jackson-core
jackson-databind
libbrotli1
libevent-2.1-7t64
libexpat1
libpcre2-8-0
libperl5.40
libpython3.13-minimal
libpython3.13-stdlib
libssl3t64
urllib3
On this page