.. SPDX-FileCopyrightText: 2026 Univention GmbH
..
.. SPDX-License-Identifier: AGPL-3.0-only
.. _v1.23.x:
**************
Version 1.23.x
**************
Release notes for Nubus for Kubernetes 1.23.x:
* :ref:`v1.23.0`
.. _v1.23.0:
Version 1.23.0 - 2026-09-15
===========================
.. admonition:: Upgrade path
For the upgrade to version 1.23.0,
your deployment must run on version 1.22.x or 1.21.x.
For the general steps to upgrade an existing Nubus for Kubernetes deployment,
see :external+uv-nubus-kubernetes-operation:ref:`nubus-upgrade`
in :cite:t:`uv-nubus-kubernetes-operation`.
.. _v1.23.0-highlights:
Release highlights
------------------
Guardian returns, based on `Cerbos `_
The *Guardian* component is back in the Nubus umbrella chart.
The new implementation uses `Cerbos `_
as its policy decision point.
It lays the foundation for fine-grained authorization
in future Nubus releases.
Keycloak container hardened
The *Keycloak* main container now mounts most volumes read-only.
This reduces the attack surface
by limiting the paths in the container that are writable at runtime.
SCIM client improvements
The *SCIM client* receives several improvements in this release,
including object-type specific search endpoints
and experimental support for group provisioning.
.. _v1.23.0-migration-steps:
Migration steps
---------------
This section lists necessary migration steps
that may apply to you.
You need to run them **before** the upgrade.
#. Operators who configured the *Notifications API*
can remove all Helm Chart values under ``nubusNotificationsApi``
from their custom values files.
Nubus no longer provisions the PostgreSQL database ``notificationsapi``
and its database user.
After the upgrade,
operators can drop the database and the database user
from their PostgreSQL instance.
.. _v1.23.0-changes:
Changes
-------
This section lists the changes in 1.23.0 grouped by component in Nubus for Kubernetes.
.. _v1.23.0-changes-guardian:
Guardian
~~~~~~~~
Nubus for Kubernetes adds the *Guardian* component to the umbrella chart again.
The new *Guardian* builds on `Cerbos `_
as its policy decision point.
It provides no functionality yet
and is deactivated by default with the value ``false``
in the Helm Chart value :envvar:`nubusGuardian.enabled`.
Activating it doesn't alter the behavior of your deployment.
.. _v1.23.0-changes-kerberos-enctypes:
Kerberos encryption types
~~~~~~~~~~~~~~~~~~~~~~~~~
Nubus for Kubernetes 1.22 announced that the *UDM HTTP REST API*
only writes strong Kerberos encryption types.
The change didn't take effect,
and the component kept writing the weak types as well.
Version 1.23 fixes this.
The *UMC server* wasn't affected.
Accounts keep their Kerberos keys until their next password change.
Therefore accounts from 1.22, or from an earlier version,
still have weak keys after the upgrade.
To remove them,
run the ``remove_krb5key_keytypes`` script in the *UDM HTTP REST API*
as described in :ref:`v1.22.kerberos-remove-keytypes`.
.. _v1.23.0-changes-notifications-api:
Notifications API
~~~~~~~~~~~~~~~~~
Nubus for Kubernetes removes the *Notifications API* from the umbrella Helm Chart.
The component is deprecated and no longer part of a Nubus deployment.
The *Portal Server* feature toggle
:envvar:`nubusPortalServer.portalServer.featureToggles.notifications_api`
is deactivated by default with the value ``false``.
.. _v1.23.0-changes-portal-frontend:
Portal Frontend
~~~~~~~~~~~~~~~
The right sidebar of the portal now shows the display name of the signed-in user
and falls back to the username if no display name is set.
Earlier versions only showed the username.
Included errata updates
-----------------------
The errata updates contain fixes for the following CVEs:
:program:`binutils`
* :uv:cve:`2026-19582` (unknown)
:program:`binutils-common`
* :uv:cve:`2026-19582` (unknown)
:program:`binutils-x86-64-linux-gnu`
* :uv:cve:`2026-19582` (unknown)
:program:`bsdutils`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`curl`
* :uv:cve:`2025-10148` (medium)
* :uv:cve:`2025-14524` (medium)
* :uv:cve:`2025-14819` (medium)
* :uv:cve:`2026-3783` (medium)
* :uv:cve:`2026-3784` (medium)
* :uv:cve:`2026-7168` (medium)
:program:`libbinutils`
* :uv:cve:`2026-19582` (unknown)
:program:`libblkid1`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`libctf-nobfd0`
* :uv:cve:`2026-19582` (unknown)
:program:`libctf0`
* :uv:cve:`2026-19582` (unknown)
:program:`libcurl4`
* :uv:cve:`2025-10148` (medium)
* :uv:cve:`2025-14524` (medium)
* :uv:cve:`2025-14819` (medium)
* :uv:cve:`2026-3783` (medium)
* :uv:cve:`2026-3784` (medium)
* :uv:cve:`2026-7168` (medium)
:program:`libexpat1`
* :uv:cve:`2026-50219` (medium)
* :uv:cve:`2026-56131` (medium)
* :uv:cve:`2026-56403` (medium)
* :uv:cve:`2026-56404` (medium)
* :uv:cve:`2026-56405` (medium)
* :uv:cve:`2026-56406` (medium)
* :uv:cve:`2026-56407` (medium)
* :uv:cve:`2026-56408` (medium)
* :uv:cve:`2026-56409` (medium)
* :uv:cve:`2026-56410` (medium)
* :uv:cve:`2026-56411` (medium)
* :uv:cve:`2026-56412` (medium)
* :uv:cve:`2026-72522` (medium)
:program:`libexpat1-dev`
* :uv:cve:`2026-50219` (medium)
* :uv:cve:`2026-56131` (medium)
* :uv:cve:`2026-56403` (medium)
* :uv:cve:`2026-56404` (medium)
* :uv:cve:`2026-56405` (medium)
* :uv:cve:`2026-56406` (medium)
* :uv:cve:`2026-56407` (medium)
* :uv:cve:`2026-56408` (medium)
* :uv:cve:`2026-56409` (medium)
* :uv:cve:`2026-56410` (medium)
* :uv:cve:`2026-56411` (medium)
* :uv:cve:`2026-56412` (medium)
* :uv:cve:`2026-72522` (medium)
:program:`libgprofng0`
* :uv:cve:`2026-19582` (unknown)
:program:`liblastlog2-2`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`liblzma5`
* :uv:cve:`2026-34743` (low)
:program:`libmount1`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`libpam-modules`
* :uv:cve:`2024-22365` (medium)
:program:`libpam-modules-bin`
* :uv:cve:`2024-22365` (medium)
:program:`libpam-runtime`
* :uv:cve:`2024-22365` (medium)
:program:`libpam0g`
* :uv:cve:`2024-22365` (medium)
:program:`libpq5`
* :uv:cve:`2025-8714` (high)
* :uv:cve:`2026-14662` (high)
* :uv:cve:`2026-14664` (high)
* :uv:cve:`2026-14668` (high)
* :uv:cve:`2026-14669` (high)
* :uv:cve:`2026-14670` (high)
* :uv:cve:`2026-14671` (high)
* :uv:cve:`2026-14677` (high)
* :uv:cve:`2026-14679` (high)
* :uv:cve:`2026-14680` (high)
* :uv:cve:`2026-15741` (high)
* :uv:cve:`2026-15742` (high)
* :uv:cve:`2026-16239` (high)
* :uv:cve:`2026-18408` (high)
* :uv:cve:`2026-19385` (high)
* :uv:cve:`2026-6464` (high)
* :uv:cve:`2026-6471` (high)
* :uv:cve:`2026-14663` (medium)
* :uv:cve:`2026-14666` (medium)
* :uv:cve:`2026-14678` (medium)
* :uv:cve:`2026-18024` (medium)
* :uv:cve:`2026-6470` (medium)
* :uv:cve:`2026-14673` (low)
* :uv:cve:`2026-16241` (low)
* :uv:cve:`2026-6469` (low)
:program:`libpython3.11-minimal`
* :uv:cve:`2026-2297` (medium)
* :uv:cve:`2026-7774` (medium)
:program:`libpython3.11-stdlib`
* :uv:cve:`2026-2297` (medium)
* :uv:cve:`2026-7774` (medium)
:program:`libpython3.13-minimal`
* :uv:cve:`2026-7774` (medium)
:program:`libpython3.13-stdlib`
* :uv:cve:`2026-7774` (medium)
:program:`libsmartcols1`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`libuuid1`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`login`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`mount`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)
:program:`nginx`
* :uv:cve:`2026-48142` (medium)
:program:`nginx-common`
* :uv:cve:`2026-48142` (medium)
:program:`openjdk-21-jre-headless`
* :uv:cve:`2026-61308` (medium)
* :uv:cve:`2026-70907` (medium)
* :uv:cve:`2026-60589` (low)
:program:`openssh-client`
* :uv:cve:`2026-55655` (medium)
:program:`postgresql-client-15`
* :uv:cve:`2025-8714` (high)
* :uv:cve:`2026-14662` (high)
* :uv:cve:`2026-14664` (high)
* :uv:cve:`2026-14668` (high)
* :uv:cve:`2026-14669` (high)
* :uv:cve:`2026-14670` (high)
* :uv:cve:`2026-14671` (high)
* :uv:cve:`2026-14677` (high)
* :uv:cve:`2026-14679` (high)
* :uv:cve:`2026-14680` (high)
* :uv:cve:`2026-15741` (high)
* :uv:cve:`2026-15742` (high)
* :uv:cve:`2026-16239` (high)
* :uv:cve:`2026-18408` (high)
* :uv:cve:`2026-19385` (high)
* :uv:cve:`2026-6464` (high)
* :uv:cve:`2026-6471` (high)
* :uv:cve:`2026-14663` (medium)
* :uv:cve:`2026-14666` (medium)
* :uv:cve:`2026-14678` (medium)
* :uv:cve:`2026-18024` (medium)
* :uv:cve:`2026-6470` (medium)
* :uv:cve:`2026-14673` (low)
* :uv:cve:`2026-16241` (low)
* :uv:cve:`2026-6469` (low)
:program:`python-dotenv`
* :uv:cve:`2026-28684` (medium)
:program:`python3-ecdsa`
* :uv:cve:`2026-33936` (medium)
:program:`python3-jose`
* :uv:cve:`2024-29370` (medium)
* :uv:cve:`2024-33663` (medium)
* :uv:cve:`2024-33664` (medium)
:program:`python3-jwcrypto`
* :uv:cve:`2026-39373` (medium)
:program:`python3-rsa`
* :uv:cve:`2020-25658` (medium)
:program:`python3.11`
* :uv:cve:`2026-2297` (medium)
* :uv:cve:`2026-7774` (medium)
:program:`python3.11-minimal`
* :uv:cve:`2026-2297` (medium)
* :uv:cve:`2026-7774` (medium)
:program:`python3.11-venv`
* :uv:cve:`2026-2297` (medium)
* :uv:cve:`2026-7774` (medium)
:program:`python3.13`
* :uv:cve:`2026-7774` (medium)
:program:`python3.13-minimal`
* :uv:cve:`2026-7774` (medium)
:program:`starlette`
* :uv:cve:`2026-48710` (medium)
* :uv:cve:`2026-48817` (medium)
* :uv:cve:`2026-54282` (medium)
:program:`util-linux`
* :uv:cve:`2026-53612` (unknown)
* :uv:cve:`2026-53614` (unknown)