Release 1.6.18
What's New
- Security fixes (see Security Advisories below)
- Bug fixes and dependency updates
Security Advisories
This release addresses two control-plane certificate and identity validation vulnerabilities. See the linked
GitHub Security Advisories for full details, impact, and affected versions.
- GHSA-mrpr-756c-xm47 (CVE pending) (Critical) - Improper peer certificate validation on the controller
cluster mesh, router links, and metrics endpoint. TLS peer checks accepted a connection when any presented
certificate chained to the trusted CA while taking the peer identity from the leaf certificate, allowing a
peer to be admitted under a forged identity without possessing a trusted key. On HA/clustered controllers
this allows joining the controller cluster as an arbitrary controller. - GHSA-cc5m-7mhm-xh9f (CVE pending) (Medium) - Control-channel connections carrying a channel-type header
bypassed router certificate and identity verification, allowing an attacker that can reach the controller
control port to be admitted as an arbitrary router identity and manipulate that router's fabric terminators,
faults, and circuit routing. Impact is limited to router data model metadata (service and identity names) and
control-plane manipulation; it does not by itself grant access to the services the network protects.
Component Updates and Bug Fixes
- github.com/openziti/ziti: v1.6.17 -> v1.6.18
- Issue #3961 - Fix router panic evaluating a process posture check when the client has reported no process/OS posture data
- Issue #3868 - [Backport-1.6] Tunneler skips iptables rules for services sharing an intercept hostname
- Issue #3957 - [Backport-1.6] Refcount wildcard-allocated intercept hostnames
- Issue #4135 - [Backport-1.6] ziti tunnel ignores --dnsSvcIpRange
- Issue #4108 - Fix controller panic / potential data corruption by copying terminator peer data, instance secret, and eventual event data out of bolt-managed memory