Security fixes
GHSA-qmr2-wp96-h9ff - API tokens bypass the user's "allowed IP ranges" restriction - #2356
A user's "Allowed IP ranges" list is enforced on interactive logins (password, SSO, OTP) and on tickets, but was never applied to API token authentication over HTTP. An API token belonging to an IP-restricted user was accepted from any source address.
Upgrade if using IP restrictions for users.
Fixes
- fix trusted client IP in HTTP authentication by @PokAhonTAS911 in #2353
- refactor SSH channel handling, extract channel registry by @Eugeny in #2332
- fixed #2325 - missing package.lock resolutions & integrity by @Eugeny in #2330
New Contributors
- @PokAhonTAS911 made their first contribution in #2353
Full Changelog: v0.27.2...v0.27.3
What's Changed
- refactor SSH channel handling, extract channel registry by @Eugeny in #2332
- fix trusted client IP in HTTP authentication by @PokAhonTAS911 in #2353
- Bump postcss from 8.5.22 to 8.5.25 in /warpgate-web by @dependabot[bot] in #2340
- add PokAhonTAS911 as a contributor for code by @allcontributors[bot] in #2355
- Bump @tanstack/svelte-virtual from 3.13.34 to 3.13.35 in /warpgate-web in the version-bumps group by @dependabot[bot] in #2342
- Bump ip-address from 10.2.0 to 10.4.0 in /warpgate-web by @dependabot[bot] in #2350
- Bump sha2 from 0.10.9 to 0.11.0 by @dependabot[bot] in #2347
- fixed #2325 - missing package.lock resolutions & integrity by @Eugeny in #2330
- request validation for tokens by @Eugeny in #2356
New Contributors
- @PokAhonTAS911 made their first contribution in #2353
Full Changelog: v0.27.2...v0.27.3
What's Changed
- refactor SSH channel handling, extract channel registry by @Eugeny in #2332
- fix trusted client IP in HTTP authentication by @PokAhonTAS911 in #2353
- Bump postcss from 8.5.22 to 8.5.25 in /warpgate-web by @dependabot[bot] in #2340
- add PokAhonTAS911 as a contributor for code by @allcontributors[bot] in #2355
- Bump @tanstack/svelte-virtual from 3.13.34 to 3.13.35 in /warpgate-web in the version-bumps group by @dependabot[bot] in #2342
- Bump ip-address from 10.2.0 to 10.4.0 in /warpgate-web by @dependabot[bot] in #2350
- Bump sha2 from 0.10.9 to 0.11.0 by @dependabot[bot] in #2347
- fixed #2325 - missing package.lock resolutions & integrity by @Eugeny in #2330
- request validation for tokens by @Eugeny in #2356
New Contributors
- @PokAhonTAS911 made their first contribution in #2353
Full Changelog: v0.27.2...v0.27.3
Contributors
Eugeny, dependabot, and 2 other contributors