Security update of the server and the appliance. The browser extension stays at 0.9.4 (unchanged; the stores keep it, no update needed).
Security
- Single sign-on (SAML): the SAML library has a newly published weakness (GO-2026-6909: elements of a signed response could be read from a foreign namespace, and a crafted response could crash the parser), with no fixed release yet. PassZit now checks every SAML response itself before the library reads it, and a parser failure only refuses the sign-in.
- Appliance hardening (from a Lynis audit of the image): SSH without forwarding and with fewer password tries per connection, kernel hardening settings, unused network protocols disabled, PostgreSQL settings readable only by PostgreSQL. Existing appliances get this with the update.
- Command line (
passzit rotate): the output of a device was read while it was still being written (found by the race detector); a failed change could show a garbled message.
Testing
Every change is now also checked with the Go race detector and by fuzzing every parser of outside data (passkeys, SSO, imports, backups, requests of the vault, the extension and the command line). Before this release: Semgrep, Trivy, Gitleaks, an OWASP ZAP scan of a fresh appliance, role probes and a crawl of every page, and a scan of the appliance image (Trivy, Lynis, testssl.sh, Nuclei). See SECURITY.md.
Other
- Chrome Web Store: the extensions page offers PassZit from the Chrome Web Store in one click (as for Microsoft Edge).
- The browser extension has its own version from now on; it changes only when the extension changes.
