gravitational/teleport v13.4.26

Teleport 13.4.26

on GitHub

Description

This release contains fixes for several high-severity security issues, as well as numerous other bug fixes and improvements.

Security Fixes

[High] Unrestricted redirect in SSO Authentication

Teleport didn’t sufficiently validate the client redirect URL. This could allow an attacker to trick Teleport users into performing an SSO authentication and redirect to an attacker-controlled URL allowing them to steal the credentials. #41836.

Warning: Teleport will now disallow non-localhost callback URLs for SSO logins unless otherwise configured. Users of the tsh login --callback feature should modify their auth connector configuration as follows:

version: vX
kind: (saml|oidc|github)
metadata:
  name: ...
spec:
  ...
  client_redirect_settings:
    allowed_https_hostnames:
      - '*.app.github.dev'
      - '^\d+-[a-zA-Z0-9]+\.foo.internal$'

The allowed_https_hostnames field is an array containing allowed hostnames, supporting glob matching and, if the string begins and ends with ^ and $ respectively, full regular expression syntax. Custom callback URLs are required to be HTTPS on the standard port (443).

[High] CockroachDB authorization bypass

When connecting to CockroachDB using Database Access, Teleport did not properly consider the username case when running RBAC checks. As such, it was possible to establish a connection using an explicitly denied username when using a different case. #41825.

[High] Long-lived connection persistence issue with expired certificates

Teleport did not terminate some long-running mTLS-authenticated connections past the expiry of client certificates for users with the disconnect_expired_cert option. This could allow such users to perform some API actions after their certificate has expired. #41829.

[High] PagerDuty integration privilege escalation

When creating a role access request, Teleport would include PagerDuty annotations from the entire user’s role set rather than a specific role being requested. For users who run multiple PagerDuty access plugins with auto-approval, this could result in a request for a different role being inadvertently auto-approved than the one which corresponds to the user’s active on-call schedule. #41831.

[High] SAML IdP session privilege escalation

When using Teleport as SAML IdP, authorization wasn’t properly enforced on the SAML IdP session creation. As such, authenticated users could use an internal API to escalate their own privileges by crafting a malicious program. #41849.

We strongly recommend all customers upgrade to the latest releases of Teleport.

Other fixes and improvements

• Fixed access request annotations when annotations contain globs, regular
  expressions, trait expansions, or claims_to_roles is used. #41938.
• Fixed session upload completion with large number of simultaneous session
  uploads. #41852.
• Stripped debug symbols from Windows builds, resulting in smaller tsh and
  tctl binaries. #41838.
• Added read-only permissions for cluster maintenance config. #41792.
• Simplified how Bots are shown on the Users list page. #41738.
• Fixed missing variable and script options in Default Agentless Installer
  script. #41721.
• Added remote address to audit log events emitted when a Bot or Instance join
  completes, successfully or otherwise. #41698.
• Upgraded application heartbeat service to support 1000+ dynamic applications. #41628.
• Fixed systemd unit to always restart Teleport on failure unless explicitly
  stopped. #41583.
• Updated Teleport package installers to reload Teleport service config after
  upgrades. #41549.
• Fixed WebUI SSH connection leak when browser tab closed during SSH connection
  establishment. #41520
• Added "login failed" audit events for invalid passwords on password+webauthn
  local authentication. #41435
• Allow setting Kubernetes Cluster name when using non-default addresses. #41356.
• Added support to automatically download CA for MongoDB Atlas databases. #41340.
• Added validation for application URL extracted from the web application
  launcher request route. #41306.
• Allow defining custom database names and users when selecting wildcard during
  test connection when enrolling a database through the web UI. #41303.
• Updated user management to explicitly deny password resets and local logins to
  SSO users. #41272.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

--

labels: security-patch=yes, security-patch-alts=v15.3.4