Skip to content

Teleport 2.0.5
Compare
Choose a tag to compare
@russjones russjones released this 03 May 22:16
· 3 commits to branch/2.0 since this release
v2.0.5
4df38ef

Description

Teleport 2.0.5 contains a variety of security fixes. We strongly encourage anyone running Teleport 2.0.0 and above to upgrade to 2.0.5.

The most pressing issues (a phishing attack which can potentially be used to extract plaintext credentials and an attack where an already authenticated user can escalate privileges) can be resolved by upgrading the web proxy. However, however all nodes need to be upgraded to mitigate all vulnerabilities.

Fixes

  • Patch for TLP-01-001 and TLP-01-003: Check redirect.
  • Patch for TLP-01-004: Always check is namespace is valid.
  • Patch for TLP-01-005: Check user principal when joining session.
  • Patch for TLP-01-006 and TLP-01-007: Validate Session ID.
  • Patch for TLP-01-008: Use a fake hash for password authentication if user does not exist.
  • Patch for TLP-01-009: Command injection in scp.
Assets 4
Loading