Question about upgrading from 0.8 to 0.10.1 about keywhiz

[mbyczkowski]

The biggest breaking changes are probably dropping support for H2 and PostgreSQL, so if you're not using those you should be fine.

We have also introduced row-level HMACs to protect records from DB tampering, but it requires a backfill to the database in order to be used (optionally you can disable it by adding rowHmacCheck: disabled to the config).

Other than that, you should check out the CHANGELOG.

[FlavioImbertDomingos]

Great, thank you!

row-level HMACs to protect records from DB tampering

I am not using it. Where can I get more information about it?

Thank you so much.

[mbyczkowski]

@alokmenghrajani do you have more information about row-level HMAC feature and potential impact for people upgrading from older versions?

[FlavioImbertDomingos]

Hi @mbyczkowski ,

I have another question.. We are using 0.8 in PCI area. The compliance people is asking me if my version 0.8 has any known vulnerability. They can't find ny CVE for Keywhiz.. Please let me know if the new releases are fixing any known vulnerability.
Best regards,
Flavio.

[mcpherrinm]

Some of Keywhiz's dependencies have had CVEs, such as jackson-databind. We haven't evaluated if those are applicable to Keywhiz, but it is best to keep upgraded. Re: row-level hmacs. You can leave validation turned off to avoid any impact. It is a new feature to reduce attack surface, by preventing database modifications. In order to turn it on, upgrading users must backfill existing entries to have the HMACs applied to them. I think there's instructions on doing that in the github PRs, not sure offhand. Alok would know

…

On Wed, Dec 11, 2019 at 10:57 AM Flavio I Domingos ***@***.***> wrote: Mat, Another question.. We are using 0.8 in PCI area. The compliance people is asking me if my version 0.8 has any know vulnerability. They can find and CVE for Keywhiz.. I am trying to delay the upgrade as much as I can since it will be a little trick for me (HSM client install, etc) at this moment. Let me know if the new releases are fixing any known vulnerability. Best regards, Flavio. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#552?email_source=notifications&email_token=AAALSQMVLVHBGJGREXXBK6LQYEZX5A5CNFSM4JOWIL62YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGUGIAA#issuecomment-564683776>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAALSQPBABSWNW36YEENGFLQYEZX5ANCNFSM4JOWIL6Q> .