257
submitted 2 years ago* (last edited 2 years ago) by otter@lemmy.ca to c/selfhosted@lemmy.world

See this post from another website for more context.

Important: Make a backup first, at least one user mentioned the update breaking their install

A new version (1.32.0) of Vaultwarden is out with security fixes:

This release has several CVE Reports fixed and we recommend everybody to update to the latest version as soon as possible.

CVE-2024-39924 Fixed via #4715

CVE-2024-39925 Fixed via #4837

CVE-2024-39926 Fixed via #4737

Release page

you are viewing a single comment's thread
view the rest of the comments
[-] sugar_in_your_tea@sh.itjust.works 12 points 2 years ago

If that works for you, great. But a self-hosted service offers a lot of convenience for a relatively small amount of added risk. Some things I like about Bitwarden/Vaultwarden:

  • can share logins easily w/ my wife, while each having our own passwords
  • nice UX for my phone and desktop (prompts for most apps that require passwords)
  • web vault so I can access my logins if I don't have my phone with me (e.g. lost phone while traveling)

And since it's self-hosted, I'm far less likely to be targeted than the official Bitwarden instance since an attacker would need to know my domain, as well as being able to exploit the vulnerability through my multiple layers (requests go through HAProxy, my VPN, and Caddy before getting to Vaultwarden). I can make it even more secure by putting it inside my VPN (I have mine routed outside my VPN for the web vault access).

this post was submitted on 12 Aug 2024
257 points (99.2% liked)

Selfhosted

62003 readers
1096 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS