Releases: warp-tech/warpgate
Release list
v0.28.3
Note
Are you interested in IaC / GitOps support in Warpgate? Contribute your thoughts/ideas/vision here: #2482
Features
Fixes
- fix(ssh): respect configured auth methods on rejection by @fergusean in #2468
- fix(ssh): prevent progress overwriting host key confirmation prompts by @Eugeny in #2478
- fix: reject target rename when the name is already taken by @BetterAndBetterII in #2470
New Contributors
- @fergusean made their first contribution in #2468
Full Changelog: v0.28.2...v0.28.3
Contributors
Assets 6
v0.28.2
Security fixes
GHSA-78rf-vg74-7cr8 - Unauthenticated connection can stall the accept loop, denying service to a protocol - #2462
Suggested action: upgrade ASAP.
A malicious or slow client can hold up the listener loop for a protocol, denying service to other clients. For Kubernetes, a single client can hold up the listener indefinitely, for other protocols it's for 1 second, or for 6 seconds if PROXY protocol is enabled.
Fixes
- fix: sort SSH target menu with natural numeric order by @BetterAndBetterII in #2464
New Contributors
- @BetterAndBetterII made their first contribution in #2464
Full Changelog: v0.28.1...v0.28.2
Contributors
Assets 6
v0.28.1
Contributors
Assets 10
v0.28.0
Before we start
Would you kindly spend 5 minutes and give your feedback on the your deployment and issues? Thank you 🙏
Subscribe to these major release notes as well as vulnerability alerts via email: 👉 https://warpgate.null.page/newsletter/
Survey results so far
Most responses were anonymous, and this is the public follow-up.
Some requested changes were already in progress while the survey was going on, and some were completed shortly afterwards.
The 0.27.x and 0.28.0 releases address several recurring requests form the survey: clustering, RDP clipboard redirection, faster playback of long terminal recordings, SSH command auditing, credential encryption at rest, and fixing IP restrictions for API tokens.
Other requests—including SSO improvements, backup and upgrade guidance, observability, SSH certificates, and web-SSH file transfer—remain on the radar.
If you responded anonymously but would like a follow-up, feel free to re-submit the survey with your email address.
Features
Credential encryption at rest - #2386
Warpgate now offers encrypting database-stored target credentials at rest. You should enable it when using an external MySQL/PostgreSQL database.
Generate a master key with openssl rand -base64 32 and set it via the WARPGATE_ENCRYPTION_KEY environment variable to automatically encrypt all present and future credentials in the database on the next service restart.
SSH shell command auditing - #2407
Commands typed by the user in an SSH shell session now emit audit log events.
Seeking index for terminal recordings - #2419
Long terminal recordings now load incrementally in the UI. Only applies to recordings made in the new version.
Changes
- feat: Make target groups collapsible by @sravan-blitz in #2387
- fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
- allow admin to configure new tab preference by @LarsSven in #2396
- fixed #2395 - slim down connection instructions UI by @Eugeny in #2409
- link to user/target from session view by @Eugeny in #2450
Fixes
- allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
- hash token and ticket secrets in the database by @Eugeny in #2410
- record password login failures even if password login is disabled by @Eugeny in #2408
- fixed #2392 - cast the log
valuesJSON column to text when searching by @huguesgr in #2417 - fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
- fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443
- count SSH pubkey failures towards IP blocking by @Eugeny in #2454
New Contributors
- @janisdombr made their first contribution in #2435
- @sravan-blitz made their first contribution in #2387
- @huguesgr made their first contribution in #2417
Full Changelog: v0.27.4...v0.28.0
Contributors
Assets 10
v0.28.0-beta.4
Changes
- link to user/target from session view by @Eugeny in #2450
- Count SSH pubkey failures towards IP blocking by @Eugeny in #2454
Full Changelog: v0.28.0-beta.3...v0.28.0-beta.4
Contributors
Assets 10
v0.28.0-beta.3
Features
- feat: Make target groups collapsible by @sravan-blitz in #2387
- fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
- Allow admin to configure new tab preference by @LarsSven in #2396
Fixes
- fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
- fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443
New Contributors
- @janisdombr made their first contribution in #2435
- @sravan-blitz made their first contribution in #2387
Full Changelog: v0.28.0-beta.2...v0.28.0-beta.3
Contributors
Assets 10
v0.28.0-beta.2
Changes
- generate seeking index for terminal recordings by @Eugeny in #2419
- fixed #2395 - slim down connection instructions UI by @Eugeny in #2409
Fixes
- Allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
- hash token and ticket secrets in the database by @Eugeny in #2410
- fixed #2399 - audit detected shell commands for web-ssh sessions by @Eugeny in #2407
- record password login failure even if password login is disabled by @Eugeny in #2408
- fixed #2392 - cast the log
valuesJSON column to text when searching by @huguesgr in #2417
New Contributors
Full Changelog: v0.27.6...v0.28.0-beta.2
Contributors
Assets 10
v0.27.6
Security fixes
GHSA-vvpj-p7j8-4rv4 - A compromised OIDC provider can inject HTML into the redirect page
Suggested action: upgrade if using an untrusted OIDC provider
If an attacker-controlled OIDC provider generates a redirect URL that contain an HTML injection, and the provider is set to use the form_post response mode, the injected HTML was rendered as-is on the redirect page served to the user. While Javascript execution was blocked by CSP, it allowed an open redirect to an arbitrary URL.
GHSA-w9jj-vpw3-5r8f - Incorrectly saved known host keys for SSH jumphosts with a Web SSH client
Suggested action: upgrade if any targets are accessed via an external jump host. Remove extraneous "known hosts" entries, if any.
When connecting to a new target behind a jump host for the first time via the Web SSH client, accepting the host key prompt creates an extraneous "known host" entry that incorrectly mapped the jump host's key to the target IP. If the attacker gains access to the jump host's private host key and they are able to intercept traffic between the jump host and the target, they could successfully perform a MitM at that connection leg.
Full Changelog: v0.27.5...v0.27.6
v0.28.0-beta.1
Features
Credential encryption at rest - #2386
Generate a master key with openssl rand -base64 32 and set it via the WARPGATE_ENCRYPTION_KEY environment variable to automatically encrypt all present and future credentials in the database.
by @Eugeny
Full Changelog: v0.27.4...v0.28.0-beta.1