.. SPDX-FileCopyrightText: 2026 Univention GmbH .. .. SPDX-License-Identifier: AGPL-3.0-only .. _v1.24.x: ************** Version 1.24.x ************** Release notes for Nubus for Kubernetes 1.24.x: * :ref:`v1.24.0` .. _v1.24.0: Version 1.24.0 - 2026-10-27 =========================== .. admonition:: Upgrade path For the upgrade to version 1.24.0, your deployment must run on version 1.23.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see :external+uv-nubus-kubernetes-operation:ref:`nubus-upgrade` in :cite:t:`uv-nubus-kubernetes-operation`. .. _v1.24.0-highlights: Release highlights ------------------ Self Service malware scan The Self Service can now scan uploaded files, for example profile pictures, for malware with an ICAP server. Keycloak update Keycloak has been updated to version 26.8.1. Please be aware of the migration steps, see :ref:`v1.24.0 - Migration steps `. .. _v1.24.0-migration-steps: Migration steps --------------- This section lists necessary migration steps that may apply to you. You need to run them **before** the upgrade. #. Operators upgrading from 1.23.0 need to follow and apply the migration steps outlined in :ref:`v1.23.1 - Migration steps `. #. **Keycloak: Audience mappers for OIDC clients** Keycloak 26.8.1 silently ignores OIDC audience mappers that use the ``Included Client Audience`` setting with a value that does not match the client ID of an existing and enabled Keycloak client. Nubus for Kubernetes 1.23.2 prepared deployments for this change, but with Keycloak 26.8.1 in 1.24.0 broken audience mappers are no longer accepted. Before the upgrade, check all OIDC clients for broken audience mappers and repair them with the ``fix-audience-mappers`` script. The command reads the Keycloak URL, realm, and administrator credentials from the most recent Keycloak bootstrap pod. Replace ``{NAMESPACE}`` with the namespace of your Nubus for Kubernetes deployment. .. code-block:: console NS={NAMESPACE} IMAGE=artifacts.software-univention.de/nubus/images/keycloak-bootstrap:26.7.4-nubus4@sha256:3e38cbff07f06905cd1bbf87390d9585d47ac6792e2608d46758787bc4d47f4f POD=$(kubectl get pods -n "$NS" -l app.kubernetes.io/name=keycloak-bootstrap \ --sort-by=.metadata.creationTimestamp -o name | tail -1) kubectl debug -n "$NS" "$POD" --copy-to=keycloak-fix-audience --container=main \ --set-image=main="$IMAGE" \ -- sh -c '/usr/share/univention-keycloak/fix-audience-mappers \ --realm "$KEYCLOAK_REALM" \ --keycloak-url "$KEYCLOAK_URL" --binduser "$KEYCLOAK_USERNAME" \ --bindpwdfile /credentials/keycloak.secret --dry-run' kubectl wait -n "$NS" --for=jsonpath='{.status.phase}'=Succeeded \ pod/keycloak-fix-audience --timeout=60s kubectl logs -n "$NS" -f keycloak-fix-audience -c main kubectl delete pod -n "$NS" keycloak-fix-audience Run the same command without the ``--dry-run`` flag to repair the OIDC audience mapper configuration on all existing OIDC clients **before** upgrading to 1.24.0. For more information, see https://help.univention.com/t/25737. .. _v1.24.0-changes: Changes ------- This section lists the changes in 1.24.0 grouped by component in Nubus for Kubernetes. .. _v1.24.0-changes-2fa-helpdesk: 2FA Helpdesk ~~~~~~~~~~~~ The ``twofa-helpdesk-backend`` container image now uses a distroless Python base image and contains only the software packages the *2FA Helpdesk* backend needs at runtime. This reduces the SBOM components in the image by 66%, from 159 to 54 software packages. The new image fixes the following security findings: * :uv:cve:`2026-54873` * :uv:cve:`2026-63374` * :uv:cve:`2026-72897` * :uv:cve:`2026-84784` * :uv:cve:`2026-89161` * :uv:cve:`2026-97687` * :uv:cve:`2026-97689` * :uv:cve:`2026-101917` * :uv:cve:`2026-102266` * :uv:cve:`2026-102267` * :uv:cve:`2026-102268` * :uv:cve:`2026-102271` * :uv:cve:`2026-102272` * :uv:cve:`2026-102273` * :uv:cve:`2026-102274` * `GHSA-6q48-6c7w-9gw2 `_ * `GHSA-6v7p-g79w-8964 `_ .. _v1.24.0-changes-guardian: Guardian ~~~~~~~~ Upgrade Cerbos in the *Guardian* to version 0.57.0. This includes fixes for the following security findings: * :uv:cve:`2026-33818` * :uv:cve:`2026-39821` * :uv:cve:`2026-46600` * :uv:cve:`2026-56851` * :uv:cve:`2026-56853` * :uv:cve:`2026-56854` * :uv:cve:`2026-56855` * :uv:cve:`2026-56857` * :uv:cve:`2026-56858` * :uv:cve:`2026-56859` * :uv:cve:`2026-56860` * :uv:cve:`2026-56862` * :uv:cve:`2026-56866` * :uv:cve:`2026-78659` * :uv:cve:`2026-78660` * :uv:cve:`2026-78662` * :uv:cve:`2026-78663` * :uv:cve:`2026-78667` * :uv:cve:`2026-78669` * :uv:cve:`2026-84303` * :uv:cve:`2026-84304` * :uv:cve:`2026-84445` * :uv:cve:`2026-94439` * :uv:cve:`2026-94440` * :uv:cve:`2026-94448` * :uv:cve:`2026-97030` * :uv:cve:`2026-97031` * :uv:cve:`2026-97032` * :uv:cve:`2026-111943` .. _v1.24.0-changes-ldap-server: LDAP server ~~~~~~~~~~~ * The leader elector sidecar container in the LDAP server primary pods now mounts the LDAP data volume read-only. The leader elector only checks whether the LDAP database exists and can no longer change it. * Disabling a user account no longer invalidates the password hash stored in the LDAP attribute ``userPassword``. This allows the Keycloak Identity Provider to distinguish a disabled account from invalid credentials and report the appropriate authentication error. The ``shadowbind`` LDAP overlay is now mandatory to ensure that disabled user accounts cannot authenticate using LDAP bind. * The ``noopsrch`` overlay has been added to LDAP server pods. * The ``shadowbind`` overlay has been adjusted to reject LDAP binds when ``shadowLastChange`` is ``0``. According to the semantics of the shadow password attributes, a value of ``shadowLastChange=0`` indicates that the password must be changed before it can be used for further authentication. .. _v1.24.0-changes-portal-frontend: Portal Frontend ~~~~~~~~~~~~~~~ The *Your profile* page in the *End User Self Service* now shows an error message if the *UMC server* doesn't save the changes, for example if the malware scan rejects an uploaded file. Earlier versions didn't show a message and the page didn't change. .. _v1.24.0-changes-provisioning: Provisioning Service ~~~~~~~~~~~~~~~~~~~~ * The job that registers the consumers now attempts to register all consumers, even if the registration of one consumer fails. The job still fails if any consumer registration fails. Previously, the job stopped at the first failed registration and skipped the remaining consumers. * Upgrade NATS to version 2.15.1. This includes fixes for the following security findings: * :uv:cve:`2026-56857` * :uv:cve:`2026-56866` * :uv:cve:`2026-78659` * :uv:cve:`2026-78660` * :uv:cve:`2026-78663` * :uv:cve:`2026-78667` * :uv:cve:`2026-78669` * :uv:cve:`2026-94439` * :uv:cve:`2026-94440` * :uv:cve:`2026-97031` * :uv:cve:`2026-97032` .. _v1.24.0-changes-keycloak-service: Keycloak service ~~~~~~~~~~~~~~~~ Upgrade Keycloak to version 26.8.1. This includes fixes for the following security findings: * :uv:cve:`2026-16103` * :uv:cve:`2026-18206` * :uv:cve:`2026-18203` * :uv:cve:`2026-18207` * :uv:cve:`2026-18208` * :uv:cve:`2026-18211` * :uv:cve:`2026-18217` * :uv:cve:`2025-66021` * :uv:cve:`2026-89298` * :uv:cve:`2026-88770` * :uv:cve:`2026-84939` * :uv:cve:`2026-8798` * :uv:cve:`2026-13505` * :uv:cve:`2026-93999` * :uv:cve:`2026-15943` * :uv:cve:`2026-18569` * :uv:cve:`2026-82968` * :uv:cve:`2026-94001` * :uv:cve:`2026-94000` * :uv:cve:`2026-94218` * :uv:cve:`2026-94215` * :uv:cve:`2026-94213` * :uv:cve:`2026-94217` * :uv:cve:`2026-96446` * :uv:cve:`2026-96445` * :uv:cve:`2026-97177` * :uv:cve:`2026-95503` * :uv:cve:`2026-97311` * :uv:cve:`2026-97846` * :uv:cve:`2026-101333` * :uv:cve:`2026-91777` * :uv:cve:`2026-103884` * :uv:cve:`2026-107121` .. _v1.24.0-changes-self-service-consumer: Self Service Consumer ~~~~~~~~~~~~~~~~~~~~~ The ``selfservice-invitation`` container image now uses a distroless Python base image and contains only the software packages the *Self Service Consumer* needs at runtime. This reduces the SBOM components in the image by 58%, from 118 to 49 software packages. The new image fixes the following security findings: * :uv:cve:`2026-54873` * :uv:cve:`2026-63349` * :uv:cve:`2026-63374` * :uv:cve:`2026-72897` * :uv:cve:`2026-84784` * :uv:cve:`2026-89161` .. _v1.24.0-changes-umc-server: UMC server ~~~~~~~~~~ * The *End User Self Service* can now scan uploaded files for malware, for example profile pictures. It sends the files over TCP to an *ICAP* service, for example :program:`c-icap` with :program:`ClamAV`. If the *ICAP* service finds malware or can't scan the file, the *End User Self Service* rejects the file. The malware scan is inactive by default. To activate it, set the value ``nubusUmcServer.selfService.malwareScan.icap.url``. For more information, see :external+uv-nubus-kubernetes-operation:ref:`conf-self-service-malware-scan` in :cite:t:`uv-nubus-kubernetes-operation`. * The UDM REST API no longer crashes on a corrupted or concurrently-evicted entry in its internal authentication cache. .. Deactivate a false positive in the prose linter that blocks the pipeline .. vale Univention.Units = NO .. See https://vale.sh/docs/formats/rst#comments * The sticky-session proxy for the *UMC server* now uses Traefik version 3.7.16. This includes fixes for the following security advisories: * `GHSA-53qr-784g-cj35 `_ * `GHSA-cw35-4q88-3rmp `_ * `GHSA-fh26-gfpp-7xxx `_ * `GHSA-mwrr-6hp4-pxr6 `_ * `GHSA-qm9f-w54v-q2qh `_ * `GHSA-qvj7-gq9c-hp7q `_ * `GHSA-rv2h-qh7j-xrjw `_ * `GHSA-mhjw-hmjv-p99x `_ * `GHSA-p8wx-ph99-xgcr `_ * `GHSA-ww7c-q3mv-xx22 `_ * `GHSA-28hp-c82p-8vqj `_ * `GHSA-hrpp-p4fc-wwf8 `_ .. vale on .. _v1.24.0-changes-udm: UDM HTTP REST API ~~~~~~~~~~~~~~~~~ * The performance of counting license usage has been improved. * UDM now preserves the account expiration date when disabling a user account. Included errata updates ----------------------- The errata updates contain fixes for the following CVEs: :program:`aiohttp` * :uv:cve:`2026-111064` (high) * :uv:cve:`2026-111066` (high) * :uv:cve:`2026-111063` (medium) * :uv:cve:`2026-111065` (medium) * :uv:cve:`2026-111748` (medium) * :uv:cve:`2026-111750` (medium) * :uv:cve:`2026-111749` (low) :program:`bcprov-jdk18on` * :uv:cve:`2026-8763` (critical) * :uv:cve:`2026-13506` (high) :program:`cryptography` * :uv:cve:`2023-23931` (medium) * :uv:cve:`2024-0727` (medium) * :uv:cve:`2026-34073` (low) :program:`jackson-core` * :uv:cve:`2026-89407` (high) * :uv:cve:`2026-89425` (high) :program:`jackson-databind` * :uv:cve:`2026-68497` (high) * :uv:cve:`2026-91776` (high) * :uv:cve:`2026-91777` (high) * :uv:cve:`2026-19032` (medium) * :uv:cve:`2026-83557` (medium) :program:`libbrotli1` * :uv:cve:`2026-111497` (critical) :program:`libevent-2.1-7t64` * :uv:cve:`2026-63379` (medium) * :uv:cve:`2026-63381` (medium) :program:`libexpat1` * :uv:cve:`2026-32776` (medium) * :uv:cve:`2026-32777` (medium) * :uv:cve:`2026-24515` (low) * :uv:cve:`2026-32778` (low) :program:`libpcre2-8-0` * :uv:cve:`2026-89161` (high) * :uv:cve:`2026-89157` (medium) * :uv:cve:`2026-89158` (medium) * :uv:cve:`2026-89156` (low) * :uv:cve:`2026-89160` (low) * :uv:cve:`2026-89162` (low) :program:`libperl5.40` * :uv:cve:`2025-15649` (medium) * :uv:cve:`2026-19487` (medium) * :uv:cve:`2026-7010` (medium) :program:`libpython3.13-minimal` * :uv:cve:`2026-0864` (medium) * :uv:cve:`2026-4360` (low) * :uv:cve:`2026-6879` (low) :program:`libpython3.13-stdlib` * :uv:cve:`2026-0864` (medium) * :uv:cve:`2026-4360` (low) * :uv:cve:`2026-6879` (low) :program:`libssl3t64` * :uv:cve:`2026-54873` (high) * :uv:cve:`2026-72897` (high) * :uv:cve:`2026-84784` (high) * :uv:cve:`2026-35189` (medium) * :uv:cve:`2026-42772` (medium) * :uv:cve:`2026-75804` (medium) * :uv:cve:`2026-75805` (medium) * :uv:cve:`2026-75806` (medium) * :uv:cve:`2026-35191` (low) * :uv:cve:`2026-54872` (low) * :uv:cve:`2026-54875` (low) * :uv:cve:`2026-77696` (low) :program:`urllib3` * :uv:cve:`2026-97687` (high) * :uv:cve:`2026-97689` (high) * :uv:cve:`2026-97688` (medium)