Skip to content

Teleport 9.3.25
Compare
Choose a tag to compare
@zmb3 zmb3 released this 23 Dec 23:20
· 10452 commits to master since this release
v9.3.25
5cfcb4c

Description

This release of Teleport contains multiple security fixes, improvements and bug fixes.

[High] Application Access session hijack

When accepting Application Access requests, Teleport did not sufficiently
validate client credentials.

This could allow an attacker in possession of a valid active application session
ID to issue requests to this application impersonating the session owner for a
limited time window.

Presence of multiple “cert.create” audit events (code TC000I) with the same app
session ID in the “route_to_app.session_id” field may indicate the attempt to
impersonate an existing user’s application session.

[Low] Web API session caching

After logging out via the web UI, a user’s session could remain cached in
Teleport’s proxy, allowing continued access to resources for a limited time
window.

Other improvements and fixes

  • Fixed LDAP pagination issues in desktop access. #19535
  • Fixed issue with SSH sessions inheriting OOM score of parent process. #19523
  • Fixed issue with session.start event being overwritten by session.exec event. #19499
  • Fixed issue with SNI info not being set by tsh login --format kubernetes command. #19434
  • Fixed issue with websocket connections to HTTP/2 enabled apps over app access. #19425
  • Fixed issue with SAML connector validation calling issuer URL before auth checks. #19319
  • Improved tsh ls -R latency. #19484
  • Improved handling of corrupted session recordings. #19263
  • Improved web UI SSH performance. #19191
  • Improved performance of traits to roles mapping. #19182

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

labels: security-patch=yes

Assets 2