gravitational · r0mant · Sep 20, 2023 · Sep 20, 2023
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,73 @@
 # Changelog
 
+## 12.4.18 (09/20/23)
+
+### Security fixes
+
+#### [Critical] Privilege escalation via host user creation
+
+When using automatic Linux user creation, an attacker could exploit a race
+condition in the user creation functionality to create arbitrary files on the
+system as root writable by the created user.
+
+This could allow the attacker to escalate their privileges to root.
+
+Users who aren't using automatic Linux host user creation aren’t affected by
+this vulnerability.
+
+[#32209](https://github.com/gravitational/teleport/pull/32209)
+
+#### [High] Insufficient auth token verification when signing self-hosted database certificates
+
+When signing self-hosted database certificates, Teleport did not sufficiently
+validate the authorization token type.
+
+This could allow an attacker to sign valid database access certificates using a
+guessed authorization token name.
+
+Users who aren’t using self-hosted database access aren’t affected by this
+vulnerability.
+
+[#32216](https://github.com/gravitational/teleport/pull/32216)
+
+#### [High] Privilege escalation via untrusted config file on Windows
+
+When loading the global tsh configuration file tsh.yaml on Windows, Teleport
+would look for the file in a potentially untrusted directory.
+
+This could allow a malicious user to create harmful command aliases for all tsh
+users on the system.
+
+Users who aren’t using tsh on Windows aren’t affected by this vulnerability.
+
+[#32224](https://github.com/gravitational/teleport/pull/32224)
+
+#### [High] XSS in SAML IdP
+
+When registering a service provider with SAML IdP, Teleport did not sufficiently
+validate the ACS endpoint.
+
+This could allow an attacker to execute arbitrary code at the client-side
+leading to privilege escalation.
+
+This issue only affects Teleport Enterprise Edition. Enterprise users who aren’t
+using Teleport SAML IdP functionality aren’t affected by this vulnerability.
+
+[#32251](https://github.com/gravitational/teleport/pull/32251)
+
+### Other fixes and improvements
+
+* Fixed directory sharing in Desktop Access for non-ascii directory names. [#31923](https://github.com/gravitational/teleport/pull/31923)
+* Extended EC2 joining to Discovery, MDM and Okta services. [#31895](https://github.com/gravitational/teleport/pull/31895)
+* Added il-central-1 AWS region to discovery selector. [#31841](https://github.com/gravitational/teleport/pull/31841)
+* Validates unknown AWS regions from discovery matchers. [#31829](https://github.com/gravitational/teleport/pull/31829)
+* Fails with an error if desktops are created with invalid names. [#31765](https://github.com/gravitational/teleport/pull/31765)
+* Added support for bot and agent joining from external Kubernetes Clusters. [#31704](https://github.com/gravitational/teleport/pull/31704)
+* Fixed incorrect autofill in Safari. [#31592](https://github.com/gravitational/teleport/issues/31592) [#31610](https://github.com/gravitational/teleport/pull/31610)
+* Fixed desktop sessions' viewport size to the size of browser window at session start. [#31523](https://github.com/gravitational/teleport/pull/31523)
+* Updated Go to v1.20.8. [#31508](https://github.com/gravitational/teleport/pull/31508)
+* Updated OpenSSL to 3.0.11. [#32166](https://github.com/gravitational/teleport/pull/32166)
+
 ## 12.4.16 (09/05/23)
 
 * Fixed an issue in desktop discovery that unmapped IPv6 addresses. [#31433](https://github.com/gravitational/teleport/pull/31433)

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=12.4.16
+VERSION=12.4.18
 
 DOCKER_IMAGE ?= teleport
 

diff --git a/api/version.go b/api/version.go
diff --git a/build.assets/macos/tsh/tsh.app/Contents/Info.plist b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>12.4.16</string>
+		<string>12.4.18</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>12.4.16</string>
+		<string>12.4.18</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>12.4.16</string>
+		<string>12.4.18</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>12.4.16</string>
+		<string>12.4.18</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/examples/chart/teleport-cluster/Chart.yaml b/examples/chart/teleport-cluster/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "12.4.16"
+.version: &version "12.4.18"
 
 name: teleport-cluster
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "12.4.16"
+.version: &version "12.4.18"
 
 name: teleport-operator
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
@@ -1,6 +1,6 @@
 should add an operator side-car when operator is enabled:
   1: |
-    image: public.ecr.aws/gravitational/teleport-operator:12.4.16
+    image: public.ecr.aws/gravitational/teleport-operator:12.4.18
     imagePullPolicy: IfNotPresent
     livenessProbe:
       httpGet:
@@ -30,7 +30,7 @@ should add an operator side-car when operator is enabled:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -138,7 +138,7 @@ should set nodeSelector when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -216,7 +216,7 @@ should set resources when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -283,7 +283,7 @@ should set securityContext when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
@@ -5,7 +5,7 @@ should provision initContainer correctly when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v11.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       name: wait-auth-update
     - args:
       - echo test
@@ -61,7 +61,7 @@ should set nodeSelector when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -119,7 +119,7 @@ should set nodeSelector when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v11.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       name: wait-auth-update
     nodeSelector:
       environment: security
@@ -154,7 +154,7 @@ should set resources when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -219,7 +219,7 @@ should set resources when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v11.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       name: wait-auth-update
     serviceAccountName: RELEASE-NAME-proxy
     terminationGracePeriodSeconds: 60
@@ -236,7 +236,7 @@ should set securityContext for initContainers when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -301,7 +301,7 @@ should set securityContext for initContainers when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v11.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false
@@ -325,7 +325,7 @@ should set securityContext when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -390,7 +390,7 @@ should set securityContext when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v11.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport:12.4.16
+      image: public.ecr.aws/gravitational/teleport:12.4.18
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false

diff --git a/examples/chart/teleport-kube-agent/Chart.yaml b/examples/chart/teleport-kube-agent/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "12.4.16"
+.version: &version "12.4.18"
 
 name: teleport-kube-agent
 apiVersion: v2