github gravitational/teleport v4.2.12
Teleport 4.2.12

latest releases: v16.0.0-dev.flyinghermit.4, api/v16.0.0-dev.flyinghermit.4, v16.0.0-dev-tctl...
3 years ago

This release of Teleport contains a security fix.

  • Mitigated CVE-2020-15216 by updating github.com/russellhaering/goxmldsig.

Details

A vulnerability was discovered in the github.com/russellhaering/goxmldsig library which is used by Teleport to validate the
signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
bypass XML signature validation and pass off an altered file as a signed one.

Actions

The goxmldsig library has been updated upstream and Teleport 4.2.12 includes the fix. Any Enterprise SSO users using Okta,
Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.2.12 and restart Teleport.

If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

Don't miss a new teleport release

NewReleases is sending notifications on new releases.