Skip to content

v1.6.18

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 20:00
v1.6.18
This tag was signed with the committer’s verified signature.
plorenz Paul Lorenz
GPG key ID: 1A4AC953FAF6AD08
Verified
Learn about vigilant mode.
f4459ab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release 1.6.18

What's New

  • Security fixes (see Security Advisories below)
  • Bug fixes and dependency updates

Security Advisories

This release addresses two control-plane certificate and identity validation vulnerabilities. See the linked
GitHub Security Advisories for full details, impact, and affected versions.

  • GHSA-mrpr-756c-xm47 (CVE pending) (Critical) - Improper peer certificate validation on the controller
    cluster mesh, router links, and metrics endpoint. TLS peer checks accepted a connection when any presented
    certificate chained to the trusted CA while taking the peer identity from the leaf certificate, allowing a
    peer to be admitted under a forged identity without possessing a trusted key. On HA/clustered controllers
    this allows joining the controller cluster as an arbitrary controller.
  • GHSA-cc5m-7mhm-xh9f (CVE pending) (Medium) - Control-channel connections carrying a channel-type header
    bypassed router certificate and identity verification, allowing an attacker that can reach the controller
    control port to be admitted as an arbitrary router identity and manipulate that router's fabric terminators,
    faults, and circuit routing. Impact is limited to router data model metadata (service and identity names) and
    control-plane manipulation; it does not by itself grant access to the services the network protects.

Component Updates and Bug Fixes

  • github.com/openziti/ziti: v1.6.17 -> v1.6.18
    • Issue #3961 - Fix router panic evaluating a process posture check when the client has reported no process/OS posture data
    • Issue #3868 - [Backport-1.6] Tunneler skips iptables rules for services sharing an intercept hostname
    • Issue #3957 - [Backport-1.6] Refcount wildcard-allocated intercept hostnames
    • Issue #4135 - [Backport-1.6] ziti tunnel ignores --dnsSvcIpRange
    • Issue #4108 - Fix controller panic / potential data corruption by copying terminator peer data, instance secret, and eventual event data out of bolt-managed memory
Assets 11
Loading